CVE-2025-30035

Lack of API authentication allowing session generation for any user

State: Published
Severity: 9.0 Critical
Published: Mar 2, 2026
Updated: Mar 2, 2026
Reserved: Mar 14, 2025

Description

The vulnerability enables an attacker to fully bypass authentication in CGM CLININET and gain access to any active user account by supplying only the username, without requiring a password or any other credentials. Obtaining a session ID is sufficient for session takeover and grants access to the system with the privileges of the targeted user.

Scores

CVSS	Score	Vector	Source
4.0	9.0 Critical	CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H	CERT-PL

Weaknesses

CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
CGM CLININETCGM	before 2025.MS4Affected

References

https://cert.pl/en/posts/2026/03/CVE-2025-10350/third-party-advisory
https://https//www.cgm.com/pol_pl/products/szpital/cgm-clininet.htmlproduct

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.