Openemr
CVE-2026-33918
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as unprivileged OpenEMR user
-
ExploitAccess billing file-download endpoint
-
ExecutionBypass missing ACL checks
-
ImpactDownload and delete PHI claim files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated OpenEMR user account (any role) on versions prior to 8.0.0.3. Attacker must have valid session and CSRF token. No victim interaction needed. Affects billing file-download endpoint |
| Impact | The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L indicates network-based exploitation with low attack complexity requiring authenticated access with no user interaction, yielding a 7.6 severity score. The high confidentiality impact reflects exposure of PHI, while low integrity and availability impacts stem from file deletion capabilities. However, real-world risk indicators provide important context: the EPSS score of 0.03% (8th percentile) suggests minimal observed exploitation interest in the wild, no public exploit code has been identified, and the vulnerability is not listed in CISA KEV. The requirement for valid authentication (PR:L) significantly reduces the attack surface compared to unauthenticated vulnerabilities. From an SSVC perspective, exploitation requires existing account access and targets a specific healthcare application, limiting automatability. While the technical impact on confidentiality is high due to PHI exposure, the combination of low EPSS, authentication requirement, and narrow product deployment makes this a moderate priority for most organizations outside healthcare sectors actively running OpenEMR. |
| Exploit ScenarioDerived | An attacker with low-privileged credentials to an OpenEMR instance (such as a front desk staff account without billing permissions) directly accesses the interface/billing/get_claim_file.php endpoint over the network. By manipulating file parameters in HTTP requests with valid session and CSRF tokens, the attacker downloads electronic claim batch files containing patient names, diagnoses, procedures, and insurance information for hundreds of patients, then issues deletion requests to permanently remove the files and obstruct billing operations. No public exploit code exists at time of analysis, but the low attack complexity means exploitation requires only basic knowledge of the endpoint path and standard HTTP request manipulation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
Improper access control in OpenEMR versions prior to 8.0.0.3 allows any authenticated user to download and permanently delete electronic claim batch files containing protected health information (PHI) via the billing file-download endpoint, regardless of whether they have billing privileges. The vulnerability has a 7.6 CVSS score with low attack complexity and requires only low-level authentication. EPSS exploitation probability is 0.03% (8th percentile), indicating low observed targeting in real-world exploitation at time of analysis, and no public exploit has been identified.
RemediationAI
Upgrade OpenEMR to version 8.0.0.3 or later, which implements proper ACL permission checks on the billing file-download endpoint (release details at https://github.com/openemr/openemr/releases/tag/v8_0_0_3). The specific authorization fix is documented in commit f6d98d0102df0a8f131be560d9208fb65fba6188 at https://github.com/openemr/openemr/commit/f6d98d0102df0a8f131be560d9208fb65fba6188. Until patching is completed, organizations should implement compensating controls including restricting OpenEMR user account creation to only necessary personnel, conducting audit log reviews of the interface/billing/get_claim_file.php endpoint for unauthorized access attempts, implementing file integrity monitoring on claim batch directories to detect unauthorized deletions, and considering web application firewall rules to restrict access to the billing interface paths based on source IP or additional authentication factors. Organizations subject to HIPAA should evaluate whether unauthorized PHI access constitutes a reportable breach based on their specific user access patterns.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects OpenEMR (cpe:2.3:a:openemr:openemr:*:*:*:*:*:*:*:*), a web-based electronic health records and medical practice management application written in PHP. The root cause is CWE-862 (Missing Authorization), where the interface/billing/get_claim_file.php endpoint validates session tokens and CSRF protections but fails to implement role-based access control checks to verify billing privileges. This creates a horizontal privilege escalation scenario where any authenticated user, regardless of assigned role or ACL permissions, can access functionality intended exclusively for billing-privileged accounts. The endpoint processes electronic claim batch files that inherently contain sensitive protected health information, and the vulnerability permits both unauthorized disclosure (confidentiality impact) and permanent deletion (integrity and availability impacts).
Know when Openemr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the billing file-download endpoint interface/billing/get_claim_file.php only verifies that the caller has a valid session and CSRF token, but does not check any ACL permissions. This allows any authenticated OpenEMR user - regardless of whether they have billing privileges - to download and permanently delete electronic claim batch files containing protected health information (PHI). Version 8.0.0.3 patches the issue.
Executive ViewAI
OpenEMR versions prior to 8.0.0.3 contain an access control defect that permits any authenticated user to download and permanently delete billing claim files containing patient health information, bypassing intended role-based restrictions. This exposes organizations using affected versions to unauthorized access and destruction of protected health information (PHI), creating potential HIPAA compliance violations and operational disruption to claims processing.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to the billing file-download endpoint via WAF or reverse proxy to users with billing role attributes; (2) Implement application-level role verification at the endpoint to enforce billing privilege checks before file download; (3) Disable the billing file-download feature entirely if operationally feasible; (4) Enable detailed audit logging of all file access and deletion events on the billing module and retain logs for forensic review; (5) Enforce multi-factor authentication for all authenticated users to reduce risk from compromised credentials.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)GitHub Advisory
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to
Unauthenticated token disclosure in OpenEMR before 8.0.0. CVSS 10.0. PoC and patch available.
Path traversal in OpenEMR 7.0.4 disposeDocument() allows file access. PoC available.
Path traversal in OpenEMR electronic health records before fix allows authenticated users to read arbitrary files on the
SQL injection in OpenEMR electronic health records before fix. Authenticated users can execute arbitrary SQL through the
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.cl
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid par
Information disclosure in OpenEMR 5.0.2 to before 8.0.0 exposes sensitive data. PoC and patch available.
Remote code execution in OpenEMR through 8.2.0 lets an authenticated administrator poison the document category tree so
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shel
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote
Exploit-DB