The issue lies in a shared client that accepts doctor identifiers supplied by the caller for both read and write operations. Because the request is processed without any authentication or authorization check, an attacker can craft requests with arbitrary doctor identifiers. This flaw allows the attacker to read and modify patient data that belongs to a doctor the attacker has no rights to access, violating confidentiality and integrity of sensitive medical records.

The vulnerability affects CompuGroup Medical products Infantia, Phronesis, Profim, and Venere. No explicit version information is provided in the advisory, so any installations of these products that have not applied a recent fix could be vulnerable. Users should verify whether they are on the patched version once the update is released.

The CVSS score of 8 indicates a high severity vulnerability. EPSS data is not available, and the vulnerability is not currently listed in CISA KEV. The likely attack vector is a client making unauthenticated API calls to the PersonnelService; the attacker only needs network access to the service and knowledge of how to format the doctor identifier parameter. Because authentication is bypassed, the flaw can be exploited remotely without privileged credentials.