What is CVE-2026-93532?

CVE-2026-93532 is a medium-severity vulnerability in Gedelumbung Hospitalmanagement, classified under Improper Authentication. CVSS score: 6.3/10. Published 2026-09-18.

How severe is CVE-2026-93532?

Medium severity. CVSS v3 base score is 6.3 out of 10.

Auth bypass in Gedelumbung Hospitalmanagement

CVE-2026-93532

A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This issue affects the function application/modules/global/controllers/password.php::simpan/application/modules/global/controllers/profil.php::simpan of the file application/modules/global/controllers/password.php of the component Password Change Handler. Such manipulation of the argument kode_user/username leads to improper authentication. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

Vulnerability class: Broken Authentication

Published 2026-09-18 · last modified 2026-09-22.

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.

EPSS exploit prediction

EPSS: 0.005 (43.3th percentile), scored 2026-11-02.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 43rd percentile — 43.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000

Affected products

Gedelumbung Hospitalmanagement — versions c2d45543789a3887067d3915f69d44cfc2cf76a8

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

vuldb.com/vuln/407445 (technical-description, vdb-entry)
vuldb.com/vuln/407445/cti (signature, permissions-required)
vuldb.com/cve/CVE-2026-93532 (third-party-advisory)
vuldb.com/submit/943245 (third-party-advisory)
github.com/gedelumbung/HospitalManagement/issues/7 (issue-tracking, exploit)
github.com/gedelumbung/HospitalManagement/ (product)

Frequently asked questions

What is CVE-2026-93532?: CVE-2026-93532 is a medium-severity vulnerability in Gedelumbung Hospitalmanagement, classified under Improper Authentication. CVSS score: 6.3/10. Published 2026-09-18.
How severe is CVE-2026-93532?: Medium severity. CVSS v3 base score is 6.3 out of 10.