Vulnerability · Published Mar 2, 2026 · Assigned by CERT-PL

CVE-2025-30035Lack of API authentication allowing session generation for any user

Critical 9.0

In plain English

A critical-severity missing authentication in CGM CLININET from CGM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 4.0)9.0Critical

Exploit odds (30 days)0.3%top 79.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The vulnerability enables an attacker to fully bypass authentication in CGM CLININET and gain access to any active user account by supplying only the username, without requiring a password or any other credentials. Obtaining a session ID is sufficient for session takeover and grants access to the system with the privileges of the targeted user.

Affected products (as reported)

Vendor	Product	Versions
CGM	CGM CLININET	0 – before 2025.MS4

Weakness: CWE-306 · Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://cert.pl/en/posts/2026/03/CVE-2025-10350/ third-party-advisory
https://https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html product