Is CVE-2026-102846 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102846 being exploited in the wild.

How severe is CVE-2026-102846?

Medium severity, with a CVSS score of 4.7, published 30 September 2026.

Which products and versions are affected?

Gedelumbung HospitalManagement up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8.

Is there a fix for CVE-2026-102846?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-102846 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-102846?

Check whether you run Gedelumbung HospitalManagement at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102846: gedelumbung HospitalManagement improper authorization in configuration handler

CVE-2026-102846 · Severity: medium · CVSS 4.7 · Published 2026-09-30

A hospital management system contains an authorization flaw that allows authenticated administrators to modify critical system settings without proper validation. An attacker with admin access can change the password encryption salt, rendering all user credentials invalid, redirect the application to a phishing site, or inject malicious content into web pages viewed by staff and patients.

Technologies: Gedelumbung HospitalManagement. Vendors: Gedelumbung.

Quick answers

Is CVE-2026-102846 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102846 being exploited in the wild.
How severe is CVE-2026-102846?: Medium severity, with a CVSS score of 4.7, published 30 September 2026.
Which products and versions are affected?: Gedelumbung HospitalManagement up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8.
Is there a fix for CVE-2026-102846?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-102846 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-102846?: Check whether you run Gedelumbung HospitalManagement at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The simpan() function in sistem.php accepts any value for the tipe parameter and stores it as a global variable without allowlist validation. An authenticated admin can overwrite critical settings like key_login (password salt), base_url, and site_title by submitting POST requests with unvalidated input. This enables credential invalidation, redirect hijacking, and stored XSS chaining with other vulnerabilities.

Affected products

gedelumbung HospitalManagement up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8

Timeline

2026-09-30: disclosed: Vulnerability reported as CVE-2026-102846
2026-08-25: advisory: Issue opened on GitHub by ThanatosXingYu

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.