ADMX hospital system leaks patient records via IDOR
CVE-2025-4596 in Asseco ADMX hospital information system allows authenticated patients to access other patients' medical files through parameter manipulation.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska has disclosed CVE-2025-4596, an insecure direct object reference (IDOR) vulnerability in Asseco ADMX, a hospital information system used for processing medical records. The flaw allows authenticated patients to access medical files belonging to other patients by manipulating GET request parameters containing document IDs. This represents a significant privacy breach in a healthcare context, as patient medical records are subject to strict regulatory protections.
The vulnerability was reported through responsible disclosure by Wiktor Mróz and has been patched in ADMX version 6.09.01.62. Organizations running ADMX should prioritize upgrading to the fixed version to prevent unauthorized access to sensitive patient health information. The issue affects the confidentiality of medical data but requires authenticated access to exploit.
Mentioned in this report
Detection guidance
Potential IDOR Exploitation via Sequential Document ID Manipulation in Web Requests
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects an authenticated web session issuing GET requests with rapidly incrementing or non-owned document/record ID parameters, consistent with IDOR-style enumeration of medical records in systems like ADMX (CVE-2025-4596). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Sequential Document ID Parameter Enumeration in Web Application Requests
id: 57556fdd-4ec3-52c3-b4d4-055770885d19
status: experimental
description: 'Detects HTTP GET requests to a web application that reference document,
record, or file identifiers via query parameters, where the same authenticated user
rapidly requests many distinct ID values in a short window. This pattern is consistent
with Insecure Direct Object Reference (IDOR) exploitation such as CVE-2025-4596
in Asseco ADMX, where authenticated patients manipulated document ID parameters
to access other patients'' medical records. Because this rule cannot express a count/threshold
in the condition, SOC analysts should treat repeated matches from the same user/session
within a short period (e.g. more than 15 distinct IDs per minute) as the actionable
signal.
'
references:
- https://cve.mitre.org/cgirequest.cgi?name=CVE-2025-4596
logsource:
category: webserver
detection:
selection:
cs-uri-query|re: (?i)(doc(ument)?id|record(id)?|fileid|patientid)=[0-9]+
cs-method: GET
sc-status: 200
filter_static_assets:
cs-uri-stem|contains:
- /static/
- /assets/
- /css/
- /js/
condition: selection and not filter_static_assets
falsepositives:
- Legitimate clinical staff or patients browsing multiple of their own documents in
a single session
- Automated QA/monitoring scripts that enumerate document IDs for health checks
- Bulk export or migration tooling accessing records sequentially
level: medium
tags:
- attack.t1213
- cve.2025.4596
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/01/CVE-2025-4596
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs