CVE-2026-118461
AIS PersonnelService client performs unauthenticated doctor-specific operations
CVE-2026-118461 is a high vulnerability (CVSS 8.0) in Compugroup Medical Infantia, published November 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. No source names a fixed version.
- Severity
- 8.0 HighCVSS 4.0, CVE List
- Exploit chance
- 0.32%EPSS, 25th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
Affected products
What each source reports
CVE List Score used
AIS PersonnelService client performs unauthenticated doctor-specific operations
The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials.
- Record
CVE-2026-118461- CVSS 4.0
- 8.0 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-306
- Updated
- 2026-11-09
EUVDEUVD-2026-120023
The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials.
- Record
EUVD-2026-120023- CVSS 4.0
- 8.0 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U - Updated
- 2026-11-09
GitHub AdvisoriesGHSA-p9jj-2fc3-42p6
The shared client accepts caller-controlled doctor identifiers for read and write operations...
The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials.
- Record
GHSA-p9jj-2fc3-42p6- CVSS 4.0
- 8.0 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-306
- Updated
- 2026-11-09
NVD
The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials.
- Record
CVE-2026-118461- CVSS 4.0
- 8.0 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-306
- Updated
- 2026-11-09
History
| Recorded | Changed | Sources |
|---|---|---|
| published | EUVD | |
| published | EUVD, NVD | |
| aliases, published | EUVD | |
| aliases, references | GitHub Advisories | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical
cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html
nvd.nist.gov/vuln/detail/CVE-2026-118461
github.com/advisories/GHSA-p9jj-2fc3-42p6