What is the CVSS score of CVE-2026-33918?

CVE-2026-33918 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-33918?

OpenEMR versions prior to 8.0.0.3 contain an access control defect that permits any authenticated user to download and permanently delete billing claim files containing patient health information,…

How to fix or mitigate CVE-2026-33918?

Within 24 hours: Audit access logs for the billing file-download endpoint to identify unauthorized access or deletion activity by non-billing staff. Within 7 days: Implement network-level restrictions limiting endpoint access to users with documented billing responsibilities, or disable the billing file-download feature if not operationally critical. Within 30 days: Upgrade to OpenEMR 8.0.0.3 or later once available and tested in a non-production environment, or apply vendor-provided compensating controls if upgrade cannot be completed.

PHP CVE-2026-33918

HIGH

Missing Authorization (CWE-862)

2026-03-25 GitHub_M

PHP Privilege Escalation Information Disclosure Openemr

7.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 25, 2026 - 23:47 vuln.today

CVE Published

Mar 25, 2026 - 23:35 nvd

HIGH 7.6

DescriptionGitHub Advisory

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the billing file-download endpoint interface/billing/get_claim_file.php only verifies that the caller has a valid session and CSRF token, but does not check any ACL permissions. This allows any authenticated OpenEMR user - regardless of whether they have billing privileges - to download and permanently delete electronic claim batch files containing protected health information (PHI). Version 8.0.0.3 patches the issue.

AnalysisAI

Improper access control in OpenEMR versions prior to 8.0.0.3 allows any authenticated user to download and permanently delete electronic claim batch files containing protected health information (PHI) via the billing file-download endpoint, regardless of whether they have billing privileges. The vulnerability has a 7.6 CVSS score with low attack complexity and requires only low-level authentication. EPSS exploitation probability is 0.03% (8th percentile), indicating low observed targeting in real-world exploitation at time of analysis, and no public exploit has been identified.

Technical ContextAI

The vulnerability affects OpenEMR (cpe:2.3:a:openemr:openemr:*:*:*:*:*:*:*:*), a web-based electronic health records and medical practice management application written in PHP. The root cause is CWE-862 (Missing Authorization), where the interface/billing/get_claim_file.php endpoint validates session tokens and CSRF protections but fails to implement role-based access control checks to verify billing privileges. This creates a horizontal privilege escalation scenario where any authenticated user, regardless of assigned role or ACL permissions, can access functionality intended exclusively for billing-privileged accounts. The endpoint processes electronic claim batch files that inherently contain sensitive protected health information, and the vulnerability permits both unauthorized disclosure (confidentiality impact) and permanent deletion (integrity and availability impacts).

RemediationAI

Upgrade OpenEMR to version 8.0.0.3 or later, which implements proper ACL permission checks on the billing file-download endpoint (release details at https://github.com/openemr/openemr/releases/tag/v8_0_0_3). The specific authorization fix is documented in commit f6d98d0102df0a8f131be560d9208fb65fba6188 at https://github.com/openemr/openemr/commit/f6d98d0102df0a8f131be560d9208fb65fba6188. Until patching is completed, organizations should implement compensating controls including restricting OpenEMR user account creation to only necessary personnel, conducting audit log reviews of the interface/billing/get_claim_file.php endpoint for unauthorized access attempts, implementing file integrity monitoring on claim batch directories to detect unauthorized deletions, and considering web application firewall rules to restrict access to the billing interface paths based on source IP or additional authentication factors. Organizations subject to HIPAA should evaluate whether unauthorized PHI access constitutes a reportable breach based on their specific user access patterns.