CVE-2026-4617 — Incorrect Privilege Assignment in Patients Waiting Area Queue Management System

CWE-266 — Incorrect Privilege AssignmentCWE-285 — Improper Authorization3 documents3 sources
Severity
6.9MEDIUMNVD
EPSS
0.1%
top 83.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Sourcecodester Patients Waiting Area Queue Management System
Timeline
PublishedMar 24

Description

A weakness has been identified in SourceCodester Patients Waiting Area Queue Management System 1.0. The impacted element is the function ValidateToken of the file /php/api_patient_checkin.php of the component Patient Check-In Module. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Packages1 packages

🔴Vulnerability Details

2
CVEList
SourceCodester Patients Waiting Area Queue Management System Patient Check-In api_patient_checkin.php ValidateToken improper authorization↗2026-03-24
▶
GHSA
GHSA-pv77-9993-vv42: A weakness has been identified in SourceCodester Patients Waiting Area Queue Management System 1↗2026-03-24
▶
CVE-2026-4617 — Incorrect Privilege Assignment | cvebase