Openemr
CVE-2026-33915
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionGitHub Advisory
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, five insurance company REST API routes are missing the RestConfig::request_authorization_check() call that every other data-modifying route in the standard API uses. This allows any authenticated API user to create and modify insurance company records even if their OpenEMR user account does not have administrative ACL permissions. Version 8.0.0.3 patches the issue.
AnalysisAI
OpenEMR versions prior to 8.0.0.3 allow authenticated API users to bypass administrative access controls on five insurance company management REST API endpoints due to missing authorization checks. An attacker with valid API credentials but non-administrative OpenEMR privileges can create, read, and modify insurance company records without proper permission validation. The vulnerability requires prior authentication and affects data integrity rather than confidentiality or availability; no public exploit code has been identified, and exploitation probability is very low (EPSS 0.02%).
Technical ContextAI
OpenEMR is a healthcare records and practice management platform (CPE:2.3:a:openemr:openemr) that implements a REST API framework with a standard authorization control mechanism: RestConfig::request_authorization_check(). This method validates whether an authenticated user possesses the necessary OpenEMR Access Control List (ACL) permissions before allowing data-modification operations. The vulnerability stems from a CWE-862 (Missing Authorization) condition where five insurance company REST API routes fail to invoke this mandatory authorization check. The affected routes can create and modify insurance company records, which are administrative data elements that should only be accessible to users holding administrative ACL roles. The absence of the authorization wrapper allows privilege escalation within the API layer for authenticated users who lack the requisite administrative permissions in their OpenEMR user account.
RemediationAI
Upgrade OpenEMR to version 8.0.0.3 or later immediately; this is the only complete fix (see vendor advisory at https://github.com/openemr/openemr/security/advisories/GHSA-ww94-26v7-x4gp and releases at https://github.com/openemr/openemr/releases/tag/v8_0_0_3). For organizations unable to patch immediately, implement compensating controls: restrict API access to trusted internal networks or VPN-authenticated ranges only, enable detailed logging and alerting on all insurance company record creation and modification events to detect unauthorized changes, and enforce role-based API key segregation so that non-administrative users are issued API credentials with minimal necessary scopes. Review recent audit logs in affected OpenEMR instances to identify any unauthorized insurance record modifications that may have occurred while running an unpatched version.
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to
Unauthenticated token disclosure in OpenEMR before 8.0.0. CVSS 10.0. PoC and patch available.
Path traversal in OpenEMR 7.0.4 disposeDocument() allows file access. PoC available.
Path traversal in OpenEMR electronic health records before fix allows authenticated users to read arbitrary files on the
SQL injection in OpenEMR electronic health records before fix. Authenticated users can execute arbitrary SQL through the
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.cl
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid par
Information disclosure in OpenEMR 5.0.2 to before 8.0.0 exposes sensitive data. PoC and patch available.
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shel
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote
OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code
Same weakness CWE-862 – Missing Authorization
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today