CGM CLININET Authorization Bypass Vulnerability Allowing Access to Other Users' Messages and Attachments
Vulnerability
A vulnerability exists in the CGM CLININET application due to the use of direct, sequential object identifiers 'MessageID' without adequate authorization checks. This flaw allows attackers to modify the 'MessageID' parameter in GET requests to access messages and attachments belonging to other users. The vulnerability affects all CGM CLININET versions prior to 2025.MS4.
Impact
Exploitation of this vulnerability allows for unauthorized access to messages and attachments of other users.
Added: Mar 2, 2026, 12:18 PM
Updated: Mar 2, 2026, 12:18 PM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
2.5exploitability
5.2remediation
0.0relevance
3.4threat
0.0urgency
2.9incentive
0.0Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.