CERT Polska has published a coordinated disclosure covering drEryk Gabinet, a medical practice application used in Poland, after a researcher found the software shipping with login details written into the program itself. The flaw is tracked as CVE-2026-17038 and affects every version before 11.5.0.
The credentials sit in the part of the application that reports support tickets. According to CERT Polska's advisory, they can be used to authenticate directly against the ticket system API, which lets someone holding them carry out privileged operations the application itself never offers, including reading and modifying tickets.
Why a baked-in password is different
The weakness class here is CWE-798, use of hard-coded credentials, and the distinction matters. A password a customer sets is theirs to change or revoke. A credential compiled into shipped software is not configured per site, so it is not something an individual practice can rotate, and finding it once is a matter of examining a copy of the program rather than attacking anyone. That is why the fix has to come as a new release from the vendor rather than as advice to users.
CERT Polska publishes no CVSS score for the issue and describes no exploitation. It states what the credentials reach and stops there, so nothing beyond ticket system access should be read into it. The vendor's own advisory would be the place to look for anything further.
Update to 11.5.0 or later
The vulnerable range is stated as all versions before 11.5.0, which makes the remediation unambiguous: practices running drEryk Gabinet should move to 11.5.0 or newer. There is no workaround to apply in the meantime, because the credentials cannot be changed by the people running the software.
The report reached CERT Polska through its coordinated vulnerability disclosure programme, and the team credits Wojciech Giełda for reporting it responsibly. CERT Polska handled the coordination between the researcher and the vendor before the details went public, which is the process it maintains for exactly this kind of finding in software used across Poland.
Clinical and administrative software from smaller specialist vendors keeps producing findings of this shape. IntelFusions reported a close parallel only last week, when a document management server was found keeping Active Directory passwords in plain text. Neither is a sophisticated attack. Both are the kind of thing that gets found the first time somebody with the right instincts looks at the binary, which is an argument for more people looking.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.