What’s Vulnerable › Vulnerabilities

CVE-2025-58402: Insecure Direct Object Reference Message ID

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-02 · updated 2026-06-17
• Weakness: CWE-639

Description

The CGM CLININET application uses direct, sequential object identifiers "MessageID" without proper authorization checks. By modifying the parameter in the GET request, an attacker can access messages and attachments belonging to other users.

Affected products

• CGM CLININET: before 2025.ms4 — fixed in 2025.ms4

How to fix

Upgrade to a fixed version: CGM CLININET 2025.ms4. Check the vendor advisory for mitigations.

References

• https://cert.pl/en/posts/2026/03/CVE-2025-10350/
• https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html

Get alerted when CVE-2025-58402 or the next vulnerability affects your stack