What is the CVSS score of CVE-2026-25745?

CVE-2026-25745 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Openemr are affected by CVE-2026-25745?

Organizations using versions should be aware of notable risk from CVE-2026-25745, a IDOR vulnerability rated CVSS 6.5. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-25745?

Within 30 days: Identify affected systems running versions and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Openemr CVE-2026-25745

EUVD-2026-12952 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-18 GitHub_M

Authentication Bypass Openemr

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 18, 2026 - 21:00 euvd

EUVD-2026-12952

Analysis Generated

Mar 18, 2026 - 21:00 vuln.today

CVE Published

Mar 18, 2026 - 20:30 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

OpenEMR is a free and open source electronic health records and medical practice management application. In versions up to and including 8.0.0, the message/note update endpoint (e.g. PUT or POST) updates by message/note ID only and does not verify that the message belongs to the current patient (or that the user is allowed to edit that patient’s notes). An authenticated user with notes permission can modify any patient’s messages by supplying another message ID. Commit 92a2ff9eaaa80674b3a934a6556e35e7aded5a41 contains a fix for the issue.

AnalysisAI

OpenEMR versions up to 8.0.0 contain an authorization bypass vulnerability in the message/note update endpoints that allows authenticated users with notes permissions to modify any patient's messages without proper access control verification. An attacker can exploit this by supplying arbitrary message IDs in PUT or POST requests, enabling unauthorized modification of other patients' medical records. This is a moderate-risk issue (CVSS 6.5) with integrity impact on sensitive healthcare data, though exploitation requires existing authentication and notes permissions.

Technical ContextAI

The vulnerability exists in OpenEMR's message/note update API endpoints (affected by CVE-2026-25745, per CPE cpe:2.3:a:openemr:openemr:*:*:*:*:*:*:*:*) and stems from CWE-639 (Authorization Bypass Through User-Controlled Key), a class of flaws where access control decisions rely solely on user-supplied identifiers without validating ownership or context. The endpoints accept PUT or POST requests with message IDs as parameters but fail to verify that the message being updated belongs to the current patient or that the authenticated user has permission to edit that specific patient's records. This represents a classic insecure direct object reference (IDOR) pattern in healthcare software, where business logic authorization is absent despite authentication being in place.

RemediationAI

Organizations running OpenEMR should immediately upgrade to a patched version released after the fix commit 92a2ff9eaaa80674b3a934a6556e35e7aded5a41; verify with the vendor whether this is available as an 8.0.1 patch or requires upgrade to a newer major version. Consult the GitHub security advisory at https://github.com/openemr/openemr/security/advisories/GHSA-jm78-x5p7-52qh for the exact patched version and deployment instructions. As an interim mitigation, restrict notes permission grants to only users who need direct edit capability and implement network-level access controls limiting message API endpoints to trusted internal subnets. Conduct a post-remediation audit of message modification logs to identify any unauthorized changes to patient records during the vulnerability window.