---
id: "CVE-2026-118461"
page: "https://infrastack.ai/live/CVE-2026-118461"
kind: "vulnerability"
aliases: ["CVE-2026-118461"]
title: "CompuGroup Medical (CGM Italia) pharmacy and practice software: shared client reads and writes doctor records without authentication"
severity: "high"
cvss: 8.0
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Venere", "fixed": [], "affected": "<= 8.33.2", "ecosystem": "vendor"}, {"name": "Phronesis", "fixed": [], "affected": "<= 4.51.0.1", "ecosystem": "vendor"}, {"name": "Infantia", "fixed": [], "affected": "<= 6.09.1", "ecosystem": "vendor"}, {"name": "Profim", "fixed": [], "affected": "<= 6.09.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["cgm", "compugroup-medical", "doctor-records", "healthcare", "missing-authentication", "other", "pharmacy"]
not_affected_if: ["auto-updated-to-patched"]
published_at: "2026-11-09T12:16:37+00:00"
first_seen_at: "2026-11-09T12:26:23+00:00"
updated_at: "2026-11-09T12:29:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118461", "first_seen_at": "2026-11-09T12:26:23+00:00"}, {"source": "analyst", "url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical", "first_seen_at": "2026-11-09T12:29:34+00:00", "cites": ["https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical", "https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"]}]
exploit_sources: []
---

# CompuGroup Medical (CGM Italia) pharmacy and practice software: shared client reads and writes doctor records without authentication

Link for people: https://infrastack.ai/live/CVE-2026-118461 (this .md is for agents)

CSIRT Italia (ACN) lists this as missing authentication in the shared client (cgm.it.ais.connector) of CompuGroup Medical software. Caller-supplied identifiers are accepted for reads and writes without valid credentials, so records tied to other doctors could be read or changed. CGM says it has no evidence of exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Venere affected <= 8.33.2 fixed no fixed version listed
- vendor:Phronesis affected <= 4.51.0.1 fixed no fixed version listed
- vendor:Infantia affected <= 6.09.1 fixed no fixed version listed
- vendor:Profim affected <= 6.09.1 fixed no fixed version listed

## How to check

Check the installed version of Venere, Phronesis, Infantia or Profim against the ranges above (NVD: cgm.it.ais.connector <= 1.10.0). Also check XDent, XMedical and Wingesfar if you run them. Ask CGM support to confirm the connector version and patch state.

## Fix

No fixed version is published for this CVE. CGM says fixes are pushed automatically to affected installations, and ACN recommends updating through CGM's support channels. Confirm with CGM support.

## Timeline

- 2026-11-09T12:26:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118461
- 2026-11-09T12:29:34+00:00 analyst https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical — NVD API + ACN advisory + CGM press release read; web-cli out of Exa credits so no social search. No fixed version or PoC stated; CGM says no evidence of exploitation. Fix status left unverified.

## Documents

- [advisory] CSIRT Italia: vulnerabilità in prodotti CompuGroup Medical https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical
- [fix] CGM Italia: fixes distributed automatically, with CSIRT Italia https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html

## From the sources

The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_