The vulnerability resides in the checkin.php component of SourceCodester Patients Waiting Area Queue Management System version 1.0. By modifying the patient_id argument sent to this script, an attacker can bypass the application’s authorization checks and view or edit data belonging to other patients. This improper authorization flaw, classified as CWE‑266 and CWE‑285, enables unauthorized access to sensitive medical information. The CVSS score of 5.3 indicates a moderate severity level.

The affected product is SourceCodester’s Patients Waiting Area Queue Management System, specifically version 1.0. No other releases are reported as vulnerable, and the issue is not present in earlier or later named revisions according to the available CNA data.

The CVSS score of 5.3 places this flaw in the moderate risk category, while the EPSS score of less than 1% suggests a low probability of exploitation at present. Nonetheless, the vulnerability is publicly available as an exploit, and the lack of a KEV listing does not diminish the potential impact. Attackers can initiate the exploit remotely via HTTP requests to /checkin.php, manipulating patient_id to gain unauthorized access to patient records. Organizations using this system should assess the exposure of sensitive data and consider mitigations accordingly.