What is the CVSS score of CVE-2026-25147?

CVE-2026-25147 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-25147?

OpenEMR installations prior to version 8.0.0 contain a critical authorization flaw allowing attackers to access other patients' payment information through parameter manipulation.. A patch is available.

Is there a public PoC exploit available for CVE-2026-25147?

Yes, a public proof-of-concept exploit is available for CVE-2026-25147. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-25147?

Within 24 hours: Identify all OpenEMR instances and document current versions; notify clinical and compliance leadership of exposure scope. Within 7 days: Deploy OpenEMR version 8.0.0 or later across all affected systems; validate patch installation and confirm portal functionality. Within 30 days: Conduct audit of payment portal access logs for unauthorized patient record access; implement compensating controls if patching is delayed.

PHP CVE-2026-25147

HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-02-27 security-advisories@github.com

PHP Privilege Escalation Openemr

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 03, 2026 - 19:10 vuln.today

Public exploit code

Patch released

Mar 03, 2026 - 19:10 nvd

Patch available

CVE Published

Feb 27, 2026 - 17:16 nvd

HIGH 7.1

DescriptionGitHub Advisory

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, in portal/portal_payment.php, the patient id used for the page is taken from the request ($pid = $_REQUEST['pid'] ?? $pid and $pid = ($_REQUEST['hidden_patient_code'] ?? null) > 0 ? $_REQUEST['hidden_patient_code'] : $pid) instead of being fixed to the authenticated portal user. The portal session already has a valid $pid for the logged-in patient. Overwriting it with user-supplied values and using it without authorization allows a portal user to view and interact with another patient's demographics, invoices, and payment history-horizontal privilege escalation and IDOR. Version 8.0.0 contains a fix for the issue.

AnalysisAI

OpenEMR versions prior to 8.0.0 allow authenticated portal users to access other patients' protected health information through insecure direct object references (IDOR) in the payment portal, enabling horizontal privilege escalation to view and modify another patient's demographics, invoices, and payment history. The vulnerability stems from accepting patient ID values from user-controlled request parameters instead of validating against the authenticated user's session. Public exploit code exists for this vulnerability.

Technical ContextAI

This vulnerability (CWE-639: Authorization Bypass Through User-Controlled Key) affects Openemr. OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, in portal/portal_payment.php, the patient id used for the page is taken from the request ($pid = $_REQUEST['pid'] ?? $pid and $pid = ($_REQUEST['hidden_patient_code'] ?? null) > 0 ? $_REQUEST['hidden_patient_code'] : $pid) instead of being fixed to the authenticated portal user. The portal session already has a valid $pid for the logged-in patient. Overwriting