What is the CVSS score of CVE-2026-33931?

CVE-2026-33931 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-33931?

Organizations using OpenEMR should be aware of notable risk from CVE-2026-33931, a IDOR vulnerability rated CVSS 6.5. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-33931?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

PHP CVE-2026-33931

MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-25 GitHub_M

PHP Information Disclosure Openemr

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 25, 2026 - 23:47 vuln.today

CVE Published

Mar 25, 2026 - 23:36 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an Insecure Direct Object Reference (IDOR) vulnerability in the patient portal payment page allows any authenticated portal patient to access other patients' payment records - including invoice/billing data (PHI) and payment card metadata - by manipulating the recid query parameter in portal/portal_payment.php. Version 8.0.0.3 patches the issue.

AnalysisAI

OpenEMR portal payment pages prior to version 8.0.0.3 expose other patients' protected health information (PHI) and payment card metadata through an Insecure Direct Object Reference vulnerability. Authenticated portal patients can manipulate the recid query parameter in portal/portal_payment.php to access arbitrary patient payment records and billing data without authorization. The vulnerability affects all versions before 8.0.0.3 and carries a CVSS score of 6.5 (high confidentiality impact); however, the 0.03% EPSS score indicates low real-world exploitation probability, and no public exploit code or active exploitation has been identified.

Technical ContextAI

The vulnerability exists in the OpenEMR patient portal payment processing module, specifically the portal/portal_payment.php script. It is a classic Insecure Direct Object Reference (IDOR) flaw classified under CWE-639, where application-controlled object references are exposed to end users without proper authorization checks. The affected product is OpenEMR (cpe:2.3:a:openemr:openemr:*:*:*:*:*:*:*:*), a PHP-based electronic health records and medical practice management system. The vulnerability stems from insufficient access control logic that fails to validate whether an authenticated user has permission to view the payment record associated with a given recid parameter, allowing horizontal privilege escalation within the patient portal context.

RemediationAI

Upgrade OpenEMR to version 8.0.0.3 or later as released by the vendor. This patch introduces proper access control validation in the portal payment page to verify that authenticated users can only access their own payment records. Organizations unable to upgrade immediately should implement network-level controls restricting patient portal access to known IP ranges and monitor access logs for suspicious recid parameter patterns. Additionally, conduct a forensic review of patient portal access logs prior to this patch to identify any unauthorized access to payment records, and notify affected patients per HIPAA breach notification requirements if unauthorized disclosure is confirmed.