Openemr
CVE-2026-33931
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionGitHub Advisory
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an Insecure Direct Object Reference (IDOR) vulnerability in the patient portal payment page allows any authenticated portal patient to access other patients' payment records - including invoice/billing data (PHI) and payment card metadata - by manipulating the recid query parameter in portal/portal_payment.php. Version 8.0.0.3 patches the issue.
AnalysisAI
OpenEMR portal payment pages prior to version 8.0.0.3 expose other patients' protected health information (PHI) and payment card metadata through an Insecure Direct Object Reference vulnerability. Authenticated portal patients can manipulate the recid query parameter in portal/portal_payment.php to access arbitrary patient payment records and billing data without authorization. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Vulnerability AssessmentAI
| Risk Assessment | While the CVSS score of 6.5 reflects high confidentiality impact, multiple risk signals suggest limited real-world exploitation likelihood. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A legitimate OpenEMR patient logs into the patient portal and iterates through sequential or random `recid` parameter values in the payment page URL, systematically accessing other patients' invoice records, billing amounts, and payment card metadata without authorization. Exploitation requires only network access and valid patient portal credentials; the low CVSS complexity and requirement for legitimate authentication means an attacker with a single patient account can enumerate and exfiltrate payment records from other patients through a simple parameter manipulation attack. … |
| Remediation | Upgrade OpenEMR to version 8.0.0.3 or later as released by the vendor. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today