{"id":"CVE-2026-114249","kind":"vulnerability","aliases":["CVE-2026-114249"],"related":[],"title":"Insurance-Management-System: policy holder update form lacks authorization checks","description":"A vulnerability was detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This vulnerability affects unknown code of the file /Agent/includes/UpdatePolicyHolder-inc.php of the component Policy Holder Update Form. The manipulation of the argument Policy_no results in improper authorization. It is possible to launch the attack remotely. The exploit is now public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.","summary":"A PHP file in the dhikshitha29 Insurance-Management-System project accepts a Policy_no argument without proper authorization checks. A remote attacker can manipulate that value to act on policies they should not be able to change, and a public exploit exists.","severity":"high","cvss":7.5,"epss":0.00301,"exploited":false,"exploited_at":null,"products":[{"name":"Insurance-Management-System","fixed":[],"affected":"commits 91de5edda5baa109ad8e9baf03ce6a3ceda84183, 125362cc21dca20d74091a4913a5096bb58dd837","ecosystem":"github"}],"ecosystems":[],"tags":["idor","insurance-management-system","package","php","self-hosted","unauthenticated"],"not_affected_if":["agent-path-blocked","endpoint-not-exposed","not-deployed"],"how_to_check":"- Check whether Agent/includes/UpdatePolicyHolder-inc.php exists in your deployment (any copy of the repo at commit 125362cc21dca20d74091a4913a5096bb58dd837 or 91de5edda5baa109ad8e9baf03ce6a3ceda84183).\n- Verify the file has no session_start()/$_SESSION check; if so it is exposed.\n- From outside, POST without a session cookie to /Agent/includes/UpdatePolicyHolder-inc.php; a redirect with success= means the update ran. Use a test record only.","fix":"No fix available: the maintainer has not responded and the repo has had no push since 2021-12. Do not expose this app; add a session check and an Agency_code ownership check to Agent/includes/UpdatePolicyHolder-inc.php, or block that path at the web server.","status":"open","published_at":"2026-10-21T14:17:13+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:16:48+00:00","updated_at":"2026-10-25T03:23:44+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:16:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Insurance-Management-System: policy holder update form lacks authorization checks","impact":"medium","summary":"A PHP file in the dhikshitha29 Insurance-Management-System project accepts a Policy_no argument without proper authorization checks. A remote attacker can manipulate that value to act on policies they should not be able to change, and a public exploit exists.","category":"package","nicknames":[],"who_cares":["php","self-hosted","insurance-management-system"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker changes policy holder records they are not authorized to modify","analyst_note":"Find out whether the maintainer has released a fix or a patched commit, and confirm the authentication requirement for the Agent update endpoint from the NVD and vendor issue pages.","how_to_check":"- Look for the file `/Agent/includes/UpdatePolicyHolder-inc.php` in your deployment and check whether it is present\n- Confirm whether your copy of the project matches commit `91de5edda5baa109ad8e9baf03ce6a3ceda84183` or `125362cc21dca20d74091a4913a5096bb58dd837`\n- Check whether the Policy Holder Update Form is reachable from the internet","needs_analyst":true,"not_affected_if":["not-deployed","endpoint-not-exposed"],"who_is_affected":"Teams that deploy this PHP insurance management application and expose its Agent policy holder update form to a network. The sources say the project uses rolling releases with no version details, and the maintainer has not yet responded to the report. Teams that do not run this project can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00065,"input_tokens":3492,"output_tokens":601,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find out whether the maintainer has released a fix or a patched commit, and confirm the authentication requirement for the Agent update endpoint from the NVD and vendor issue pages.","search":"'-114249':14A,17A '-2026':13A,16A '/agent/includes/updatepolicyholder-inc.php':95C '91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837':86C 'abl':68B 'accept':44B 'act':61B 'affect':89C,147C 'approach':135C 'argument':48B,107C 'attack':55B,120C 'author':10A,51B,113C 'avail':153C 'chang':70B 'check':11A,52B 'code':91C 'compon':98C 'contini':141C 'cve':12A,15A 'deliveri':142C 'detail':145C 'detect':79C 'dhikshitha29':38B,81C 'earli':161C 'exist':75B 'exploit':74B,123C 'file':35B,94C 'form':8A,102C 'holder':6A,100C 'host':31B 'idor':22B 'improp':112C 'inform':157C 'insur':2A,24B,40B,83C 'insurance':19A 'insurance-management-system':1A,18A,23B,39B,82C 'issu':164C 'lack':9A 'launch':118C 'manag':3A,25B,41B,84C 'management':20A 'manipul':57B,104C 'may':128C 'packag':27B 'php':28B,34B 'polici':5A,46B,63B,99C,108C 'possibl':116C 'problem':160C 'product':132C 'project':43B,155C 'proper':50B 'provid':140C 'public':73B,126C 'releas':138C,150C 'remot':54B,121C 'report':165C 'respond':169C 'result':110C 'roll':137C 'self':30B 'self-host':29B 'system':4A,21A,26B,42B,85C 'take':133C 'therefor':143C 'unauthent':32B 'unknown':90C 'updat':7A,101C,149C 'use':130C 'valu':59B 'version':144C 'vulner':77C,88C 'without':49B 'yet':170C","nicknames":[],"mitigations":[],"who_affected":"Anyone running this PHP/MySQL insurance management app (dhikshitha29/Insurance-Management-System) with the Agent directory reachable over a network. No login is needed: anyone can overwrite any policy holder's name, contact details, address and nominee by guessing sequential Policy_no values. Teams not running this project can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T14:17:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-114249","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114249","severity":null,"published_at":"2026-10-21T14:17:13+00:00","modified_at":"2026-10-21T14:26:26+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114249","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114249","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114249:708","url":null,"severity":null,"published_at":"2026-10-25T03:23:44+00:00","modified_at":"2026-10-25T03:23:44+00:00","first_seen_at":"2026-10-25T03:23:44+00:00","fetched_at":"2026-10-25T03:23:44+00:00","note":"Read GitHub issue #6 (open, no maintainer reply, no fix/patch commit) and NVD. Endpoint is unauthenticated per reporter's PoC (no session check). Abandoned repo (last push 2021). No fix. Sibling SQLi CVE-2026-114243 in same project."}],"documents":[{"id":3148,"url":"https://github.com/dhikshitha29/Insurance-Management-System/issues/6","title":"Issue #6: Missing authorization in UpdatePolicyHolder-inc.php","kind":"issue","source":"analyst","text":"Open issue, no maintainer reply as of 2026-10-07. Unauthenticated POST to /Agent/includes/UpdatePolicyHolder-inc.php with Policy_no overwrites any policy holder record; no session check, no ownership check. Commit 125362cc21dca20d74091a4913a5096bb58dd837. Includes curl PoC.","published_at":null,"relation":"poc","confidence":null,"note":null},{"id":3149,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114249","title":"NVD CVE-2026-114249","kind":"advisory","source":"analyst","text":"VulDB CNA record. Affected: commits 91de5edd..., 125362cc... Rolling release, no fixed version; project informed via issue, no response.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}