{"id":"CVE-2026-118461","kind":"vulnerability","aliases":["CVE-2026-118461"],"related":[],"title":"CompuGroup Medical (CGM Italia) pharmacy and practice software: shared client reads and writes doctor records without authentication","description":"The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials.","summary":"CSIRT Italia (ACN) lists this as missing authentication in the shared client (cgm.it.ais.connector) of CompuGroup Medical software. Caller-supplied identifiers are accepted for reads and writes without valid credentials, so records tied to other doctors could be read or changed. CGM says it has no evidence of exploitation.","severity":"high","cvss":8.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Venere","fixed":[],"affected":"<= 8.33.2","ecosystem":"vendor"},{"name":"Phronesis","fixed":[],"affected":"<= 4.51.0.1","ecosystem":"vendor"},{"name":"Infantia","fixed":[],"affected":"<= 6.09.1","ecosystem":"vendor"},{"name":"Profim","fixed":[],"affected":"<= 6.09.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["cgm","compugroup-medical","doctor-records","healthcare","missing-authentication","other","pharmacy"],"not_affected_if":["auto-updated-to-patched"],"how_to_check":"Check the installed version of Venere, Phronesis, Infantia or Profim against the ranges above (NVD: cgm.it.ais.connector <= 1.10.0). Also check XDent, XMedical and Wingesfar if you run them. Ask CGM support to confirm the connector version and patch state.","fix":"No fixed version is published for this CVE. CGM says fixes are pushed automatically to affected installations, and ACN recommends updating through CGM's support channels. Confirm with CGM support.","status":"open","published_at":"2026-11-09T12:16:37+00:00","first_seen_at":"2026-11-09T12:26:23+00:00","triaged_at":"2026-11-09T12:27:16+00:00","updated_at":"2026-11-09T12:29:34+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-09T12:27:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Shared client accepts doctor IDs for reads and writes without authorization","impact":"high","summary":"The shared client accepts caller-supplied doctor identifiers for read and write operations. Because it does not require authentication or authorization credentials, an attacker can read or modify records belonging to other doctors.","audience":"businesses","category":"other","nicknames":[],"who_cares":["healthcare","doctor-records"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads and changes other doctors' records without credentials","analyst_note":"Identify the affected product and client library from NVD, and check the vendor advisory for affected versions and fix.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000619,"input_tokens":4487,"output_tokens":340,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product and client library from NVD, and check the vendor advisory for affected versions and fix.","search":"'-118461':20A,23A '-2026':19A,22A 'accept':63B,93C 'acn':43B 'authent':17A,38B,48B,106C 'author':108C 'caller':59B,95C 'caller-control':94C 'caller-suppli':58B 'cgm':3A,28B,82B 'cgm.it.ais.connector':53B 'chang':81B 'client':10A,52B,92C 'compugroup':1A,30B,55B 'compugroup-med':29B 'control':96C 'could':77B 'credenti':70B,109C 'csirt':41B 'cve':18A,21A 'doctor':14A,33B,76B,97C 'doctor-record':32B 'evid':87B 'exploit':89B 'healthcar':35B 'identifi':61B,98C 'infantia':26A 'italia':4A,42B 'list':44B 'medic':2A,31B,56B 'miss':37B,47B 'missing-authent':36B 'oper':103C 'pharmaci':5A,40B 'phronesis':25A 'practic':7A 'profim':27A 'read':11A,65B,79B,100C 'record':15A,34B,72B 'requir':105C 'say':83B 'share':9A,51B,91C 'softwar':8A,57B 'suppli':60B 'tie':73B 'valid':69B 'venere':24A 'without':16A,68B,104C 'write':13A,67B,102C","nicknames":[],"mitigations":[],"who_affected":"Pharmacies and medical or dental practices running CompuGroup Medical (CGM Italia) software: Venere 8.33.2 and earlier, Phronesis 4.51.0.1 and earlier, Infantia and Profim 6.09.1 and earlier. ACN lists XDent 4.4.0, XMedical 4.4.0 and Wingesfar before 2026.07a in the same advisory, but does not map them to this CVE; NVD lists only the four connector products. Others can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["infantia","phronesis","profim","venere"],"ptokens":["infantia","phronesis","profim","venere"],"labels":["cgm","compugroupmedical","doctorrecords","healthcare","high","missingauthentication","other","pharmacy"],"campaign_type":null,"search_a":"'-118461':20A,23A '-2026':19A,22A 'authent':17A 'cgm':3A 'client':10A 'compugroup':1A 'cve':18A,21A 'doctor':14A 'infantia':26A 'italia':4A 'medic':2A 'pharmaci':5A 'phronesis':25A 'practic':7A 'profim':27A 'read':11A 'record':15A 'share':9A 'softwar':8A 'venere':24A 'without':16A 'write':13A","search_b":"'accept':63B 'acn':43B 'authent':38B,48B 'caller':59B 'caller-suppli':58B 'cgm':28B,82B 'cgm.it.ais.connector':53B 'chang':81B 'client':52B 'compugroup':30B,55B 'compugroup-med':29B 'could':77B 'credenti':70B 'csirt':41B 'doctor':33B,76B 'doctor-record':32B 'evid':87B 'exploit':89B 'healthcar':35B 'identifi':61B 'italia':42B 'list':44B 'medic':31B,56B 'miss':37B,47B 'missing-authent':36B 'pharmaci':40B 'read':65B,79B 'record':34B,72B 'say':83B 'share':51B 'softwar':57B 'suppli':60B 'tie':73B 'valid':69B 'without':68B 'write':67B","search_c":"'accept':93C 'authent':106C 'author':108C 'caller':95C 'caller-control':94C 'client':92C 'control':96C 'credenti':109C 'doctor':97C 'identifi':98C 'oper':103C 'read':100C 'requir':105C 'share':91C 'without':104C 'write':102C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T12:16:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118461","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118461","severity":null,"published_at":"2026-11-09T12:16:37+00:00","modified_at":"2026-11-09T12:16:37+00:00","first_seen_at":"2026-11-09T12:26:23+00:00","fetched_at":"2026-11-09T12:26:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118461:2285","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical","severity":null,"published_at":"2026-11-09T12:29:34+00:00","modified_at":"2026-11-09T12:29:34+00:00","first_seen_at":"2026-11-09T12:29:34+00:00","fetched_at":"2026-11-09T12:29:34+00:00","note":"NVD API + ACN advisory + CGM press release read; web-cli out of Exa credits so no social search. No fixed version or PoC stated; CGM says no evidence of exploitation. Fix status left unverified.","cites":["https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical","https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"]}],"documents":[{"id":107407,"url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical","title":"CSIRT Italia: vulnerabilità in prodotti CompuGroup Medical","kind":"advisory","source":"analyst","publisher":null,"text":"ACN (Italy) bulletin listing 16 CVEs incl. CVE-2026-118462. Affected: XDent 4.4.0, XMedical 4.4.0, Wingesfar <2026.07a, Venere <=8.33.2, Phronesis <=4.51.0.1, Infantia <=6.09.1, Profim <=6.09.1. No fixed versions listed; update via support channels agreed with CGM. No PoC or exploitation reported.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":107410,"url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html","title":"CGM Italia: fixes distributed automatically, with CSIRT Italia","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}