drEryk Gabinet hardcoded API creds flaw fixed
DrEryk Gabinet medical software before v11.5.0 has hard-coded API credentials letting attackers read/modify support tickets.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of CVE-2026-17038, a vulnerability in drEryk Gabinet software affecting versions prior to 11.5.0. The flaw stems from hard-coded API credentials embedded in the application's ticket reporting component. These static credentials can be extracted and used to authenticate directly against the ticket system's API, bypassing normal application-level access controls.
An attacker exploiting this flaw could perform privileged operations beyond the scope intended for end users, including reading and modifying support tickets, which may contain sensitive information depending on the deployment context. There is no indication in the advisory of active exploitation in the wild; this appears to be a responsibly disclosed finding credited to researcher Wojciech Giełda. Defenders using drEryk Gabinet should upgrade to version 11.5.0 or later, which presumably removes or rotates the hard-coded credentials, and review ticket system logs for anomalous API access originating outside expected application flows.
Given the healthcare-oriented nature of the drEryk Gabinet product line (commonly used for medical practice management in Poland), organizations should prioritize patching to prevent unauthorized disclosure or tampering of support ticket data, which could include patient or operational information.
Mentioned in this report
Source reporting: https://cert.pl/en/posts/2026/09/CVE-2026-17038
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs