An authenticated attacker can manipulate encoded parameters in a request URL to bypass access controls and gain unauthorized viewing or modification rights to patient accounts within e‑Sushrut HMIS. This broken access control flaw—identified as CWE‑639—allows attackers to compromise the confidentiality and integrity of protected health information held in the system.

The affected product is CDAC‑Noida’s e‑Sushrut Hospital Management Information System (HMIS). All pre‑latest releases, as noted by the CPE string, are vulnerable; the specific version range is not stated but applies to the versions prior to the latest update.

The CVSS score of 7.1 indicates a moderate‑to‑high risk level. The EPSS score is not available, so the current probability of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated session and the ability to craft URL parameters, making it exploitable from within the user’s own account context. The threat is significant enough to warrant remediation, particularly because it impacts protected health information.