The e‑Sushrut HMIS contains an Insecure Direct Object Reference flaw that allows an authenticated user to manipulate the request URL and retrieve other patients’ sensitive information. Because the system fails to validate ownership or authorization of resources, attackers can disclose confidential medical data, violating privacy and potentially enabling further damage. The weakness maps to CWE‑639.

The flaw affects CDAC‑Noida’s e‑Sushrut Hospital Management Information System. All previous releases of the HMIS are vulnerable; the exact range of affected minor versions is not disclosed but any installment prior to the latest version lacks the fix.

The CVSS score of 7.1 indicates a high severity. The EPSS score is not publicly available, so the current exploitation probability is uncertain but the lack of a KEV listing suggests no known active exploitation. The exploit requires an authenticated session and the ability to modify URL parameters, which can be carried out remotely. Because attackers need valid credentials, the risk is significant for organizations that fail to enforce strict role‑based access control.