CVE-2026-1550 Details

A critical vulnerability has been identified in PHPGurukul Hospital Management System version 1.0. The issue resides in the Admin Dashboard component, specifically within the file '/hms/hospital/docappsystem/adminviews.py'. This vulnerability allows lower-privileged users, such as doctors and patients, to bypass authorization controls and access administrative functionalities by manually altering URL paths. The exploitation of this flaw could lead to unauthorized access to sensitive healthcare data, including personal and medical records, thereby violating healthcare data protection regulations. Additionally, the vulnerability allows for unauthorized modifications and deletions of data, disrupting the integrity and reliability of the system.

It is recommended to implement role-based access controls and server-side authorization validations for all sensitive endpoints. Applying authorization decorators or middleware to enforce access control rules based on user roles can also help mitigate this vulnerability.