---
id: "CVE-2026-114249"
kind: "vulnerability"
aliases: ["CVE-2026-114249"]
title: "Insurance-Management-System: policy holder update form lacks authorization checks"
severity: "high"
cvss: 7.5
epss: 0.00301
exploited: false
status: "open"
category: "package"
products: [{"name": "Insurance-Management-System", "fixed": [], "affected": "commits 91de5edda5baa109ad8e9baf03ce6a3ceda84183, 125362cc21dca20d74091a4913a5096bb58dd837", "ecosystem": "github"}]
ecosystems: []
tags: ["idor", "insurance-management-system", "package", "php", "self-hosted", "unauthenticated"]
not_affected_if: ["agent-path-blocked", "endpoint-not-exposed", "not-deployed"]
published_at: "2026-10-21T14:17:13+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T03:23:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114249", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114249", "first_seen_at": "2026-10-24T13:15:54+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:23:44+00:00"}]
---

# Insurance-Management-System: policy holder update form lacks authorization checks

A PHP file in the dhikshitha29 Insurance-Management-System project accepts a Policy_no argument without proper authorization checks. A remote attacker can manipulate that value to act on policies they should not be able to change, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:Insurance-Management-System affected commits 91de5edda5baa109ad8e9baf03ce6a3ceda84183, 125362cc21dca20d74091a4913a5096bb58dd837 fixed ?

## How to check

- Check whether Agent/includes/UpdatePolicyHolder-inc.php exists in your deployment (any copy of the repo at commit 125362cc21dca20d74091a4913a5096bb58dd837 or 91de5edda5baa109ad8e9baf03ce6a3ceda84183).
- Verify the file has no session_start()/$_SESSION check; if so it is exposed.
- From outside, POST without a session cookie to /Agent/includes/UpdatePolicyHolder-inc.php; a redirect with success= means the update ran. Use a test record only.

## Fix

No fix available: the maintainer has not responded and the repo has had no push since 2021-12. Do not expose this app; add a session check and an Agency_code ownership check to Agent/includes/UpdatePolicyHolder-inc.php, or block that path at the web server.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114249
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114249
- 2026-10-25T03:23:44+00:00 analyst — Read GitHub issue #6 (open, no maintainer reply, no fix/patch commit) and NVD. Endpoint is unauthenticated per reporter's PoC (no session check). Abandoned repo (last push 2021). No fix. Sibling SQLi CVE-2026-114243 in same project.

## Documents

- [advisory] NVD CVE-2026-114249 https://nvd.nist.gov/vuln/detail/CVE-2026-114249
- [poc] Issue #6: Missing authorization in UpdatePolicyHolder-inc.php https://github.com/dhikshitha29/Insurance-Management-System/issues/6

## From the sources

A vulnerability was detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This vulnerability affects unknown code of the file /Agent/includes/UpdatePolicyHolder-inc.php of the component Policy Holder Update Form. The manipulation of the argument Policy_no results in improper authorization. It is possible to launch the attack remotely. The exploit is now public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_