Openemr CVE-2026-33909

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N) indicates network-accessible vulnerability with high attack complexity and high privilege requirements, which significantly constrains real-world exploitability despite the high confidentiality and integrity impacts. The requirement for high privilege (PR:H) suggests this is an insider threat or post-authentication exploitation scenario, substantially limiting the practical attack surface compared to unauthenticated vulnerabilities. The high complexity (AC:H) further reduces exploitation probability. However, the complete lack of availability impact (A:N) and the bounded scope suggest this is a targeted data exfiltration or tampering risk rather than a denial-of-service vector. For healthcare organizations, the high confidentiality and integrity impacts on protected health information (PHI) elevate the actual business risk above the numerical CVSS score. Without confirmed EPSS or KEV status data in the provided intelligence, organizations should assume standard exploitation difficulty but prioritize patching due to healthcare regulatory requirements (HIPAA, etc.) and the sensitivity of electronic health records.

An authenticated OpenEMR administrator or privileged user with access to the MedEx recall/reminder configuration interface could inject malicious SQL code through input fields that process recall parameters. For example, a crafted recall date or patient criteria field could contain SQL commands that break out of the intended query context and extract sensitive patient data such as medication lists, diagnoses, or social security numbers from the healthcare database. Given the high complexity and privilege requirements, this attack is most likely to occur through a disgruntled insider or a compromised administrative account rather than an external attacker, but the damage to patient privacy and data integrity would be substantial.