# ADMX hospital system leaks patient records via IDOR

Published: 2026-01-08 · Severity: high · Sectors: healthcare
Canonical: https://vorant.io/reports/c8bf1636-0416-5b34-8dd1-61917a55038f/admx-hospital-system-leaks-patient-records-via-idor

> CVE-2025-4596 in Asseco ADMX hospital information system allows authenticated patients to access other patients' medical files through parameter manipulation.

CERT Polska has disclosed CVE-2025-4596, an insecure direct object reference (IDOR) vulnerability in Asseco ADMX, a hospital information system used for processing medical records. The flaw allows authenticated patients to access medical files belonging to other patients by manipulating GET request parameters containing document IDs. This represents a significant privacy breach in a healthcare context, as patient medical records are subject to strict regulatory protections.

The vulnerability was reported through responsible disclosure by Wiktor Mróz and has been patched in ADMX version 6.09.01.62. Organizations running ADMX should prioritize upgrading to the fixed version to prevent unauthorized access to sensitive patient health information. The issue affects the confidentiality of medical data but requires authenticated access to exploit.

## Mentioned in this report

- Vulnerabilities: CVE-2025-4596

## Detection guidance (public sample)

### Potential IDOR Exploitation via Sequential Document ID Manipulation in Web Requests

ATT&CK: T1213

Detects an authenticated web session issuing GET requests with rapidly incrementing or non-owned document/record ID parameters, consistent with IDOR-style enumeration of medical records in systems like ADMX (CVE-2025-4596). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Sequential Document ID Parameter Enumeration in Web Application Requests
id: 57556fdd-4ec3-52c3-b4d4-055770885d19
status: experimental
description: 'Detects HTTP GET requests to a web application that reference document,
  record, or file identifiers via query parameters, where the same authenticated user
  rapidly requests many distinct ID values in a short window. This pattern is consistent
  with Insecure Direct Object Reference (IDOR) exploitation such as CVE-2025-4596
  in Asseco ADMX, where authenticated patients manipulated document ID parameters
  to access other patients'' medical records. Because this rule cannot express a count/threshold
  in the condition, SOC analysts should treat repeated matches from the same user/session
  within a short period (e.g. more than 15 distinct IDs per minute) as the actionable
  signal.

  '
references:
- https://cve.mitre.org/cgirequest.cgi?name=CVE-2025-4596
logsource:
  category: webserver
  product: webserver
detection:
  selection:
    cs-uri-query|re: (?i)(doc(ument)?id|record(id)?|fileid|patientid)=[0-9]+
    cs-method: GET
    sc-status: 200
  filter_static_assets:
    cs-uri-stem|contains:
    - /static/
    - /assets/
    - /css/
    - /js/
  condition: selection and not filter_static_assets
falsepositives:
- Legitimate clinical staff or patients browsing multiple of their own documents in
  a single session
- Automated QA/monitoring scripts that enumerate document IDs for health checks
- Bulk export or migration tooling accessing records sequentially
level: medium
tags:
- attack.t1213
- cve.2025.4596
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/01/CVE-2025-4596

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/c8bf1636-0416-5b34-8dd1-61917a55038f/admx-hospital-system-leaks-patient-records-via-idor.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup