Skip to content
OpenAdvisories
High · 8.0 CVE-2026-118461 EUVD-2026-120023GHSA-p9jj-2fc3-42p6

AIS PersonnelService client performs unauthenticated doctor-specific operations

Published Nov 9, 2026 · Updated Nov 12, 2026 · Assigned by ENISA

Description

The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials.

Affected products

VendorProductAffectedFixed
CompuGroup Medical Infantia ≤ 1.10.0 —
CompuGroup Medical Profim ≤ 1.10.0 —
CompuGroup Medical Venere ≤ 1.10.0 —
CompuGroup Medical Phronesis ≤ 1.10.0 —

References