VENERE · CVE-2026-118461 · Other
NO FIX YET · SEE WHAT TO DO
CSIRT Italia (ACN) lists this as missing authentication in the shared client (cgm.it.ais.connector) of CompuGroup Medical software. Caller-supplied identifiers are accepted for reads and writes without valid credentials, so records tied to other doctors could be read or changed. CGM says it has no evidence of exploitation.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Pharmacies and medical or dental practices running CompuGroup Medical (CGM Italia) software: Venere 8.33.2 and earlier, Phronesis 4.51.0.1 and earlier, Infantia and Profim 6.09.1 and earlier. ACN lists XDent 4.4.0, XMedical 4.4.0 and Wingesfar before 2026.07a in the same advisory, but does not map them to this CVE; NVD lists only the four connector products. Others can skip it.
Not affected if auto-updated-to-patched
Who cares cgm, compugroup-medical, doctor-records, healthcare, missing-authentication, pharmacy
1.10.0)The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.