Openemr CVE-2026-33915

This vulnerability presents low real-world exploitation risk despite a moderate CVSS score of 5.4, based on convergent risk signals. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates network-accessible attack vector with low attack complexity, but requires prior authentication (PR:L); impact is limited to low confidentiality and integrity compromise with no availability impact. The EPSS score of 0.02% (5th percentile) indicates that fewer than 1 in 5,000 similar vulnerabilities are exploited in the wild, suggesting very low probability of practical exploitation. No CISA KEV status was provided, and no public exploit code is referenced in the intelligence data. From a SSVC perspective: exploitation is not confirmed active, the vulnerability is not automatable (requires knowledge of target's API structure and valid authentication credentials), and technical impact is limited to insurance data modification rather than system compromise. Healthcare organizations using OpenEMR should prioritize patching to 8.0.0.3, but this is not an emergency-tier vulnerability. Organizations unable to patch immediately can mitigate risk through API rate limiting, auditing of insurance record modifications, and restricting API access to trusted networks.

An authenticated API user working in a healthcare billing department has valid OpenEMR API credentials but lacks administrative ACL permissions. The user crafts HTTP requests to the unpatched insurance company REST API endpoints (which skip authorization checks) to create a fraudulent insurance company record or modify payment terms on existing insurance company accounts, without triggering any permission denial errors. Because the five vulnerable routes do not validate the user's ACL permissions, the requests succeed despite the user's non-administrative status. No public exploit code is required; the attacker only needs knowledge of the REST API endpoint paths and valid API credentials to perform the unauthorized modification.