# CVE-2026-90858: subhajitkhan online-clinic-management-system authentication bypass in admin endpoints

Source: https://junglewise.ai/threats/cve-2026-90858-subhajitkhan-online-clinic-management-system-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90858 · Severity: high · CVSS 7.3 · Published 2026-09-15

An online clinic management system fails to validate administrator authentication before executing sensitive operations. A network attacker can bypass authorization checks to read patient appointment and feedback data, approve or disable doctors, and cancel appointments without logging in. This exposes confidential patient information and allows unauthorized modification of clinic operations.

## Quick answers

**Is CVE-2026-90858 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90858 being exploited in the wild.

**How severe is CVE-2026-90858?** High severity, with a CVSS score of 7.3, published 15 September 2026.

**Which products and versions are affected?** subhajitkhan online-clinic-management-system up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578.

**Is there a fix for CVE-2026-90858?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-90858 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-90858?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in multiple administrative PHP scripts (adminappview.php, approve.php, disadd.php, admindocview.php, adminfeedbackview.php) that call session_start() but never validate the presence or validity of $_SESSION['adminmail'] before executing database queries and mutations. An unauthenticated network attacker can directly invoke these endpoints via HTTP POST/GET requests without a session cookie to read sensitive patient data, approve/disable doctors, and cancel appointments. The vulnerable functions manipulate the argument adminmail without proper authentication checks. The project operates on rolling release basis with no versioning; the vulnerability existed at least through commit e9ee77a8827a1446220fa07ee693dc4d9a29a578. A patch has not been released.

## Affected products

- subhajitkhan online-clinic-management-system up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578

## Timeline

- 2026-08-13: disclosed: Issue #4 reported on GitHub
- 2026-09-15: advisory: CVE-2026-90858 published

## References

- [https://github.com/subhajitkhan/online-clinic-management-system/](https://github.com/subhajitkhan/online-clinic-management-system/)
- [https://github.com/subhajitkhan/online-clinic-management-system/issues/4](https://github.com/subhajitkhan/online-clinic-management-system/issues/4)