What is the CVSS score of CVE-2026-33934?

CVE-2026-33934 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-33934?

Organizations using OpenEMR should be aware of moderate risk from CVE-2026-33934, a IDOR vulnerability rated CVSS 4.3. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-33934?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

PHP CVE-2026-33934

MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-26 security-advisories@github.com

PHP Authentication Bypass

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 26, 2026 - 00:22 vuln.today

CVE Published

Mar 26, 2026 - 00:16 nvd

MEDIUM 4.3

DescriptionGitHub Advisory

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have a missing authorization check in portal/sign/lib/show-signature.php that allows any authenticated patient portal user to retrieve the drawn signature image of any staff member by supplying an arbitrary user value in the POST body. The companion write endpoint (save-signature.php) was already hardened against this same issue, but the read endpoint was not updated to match. Version 8.0.0.3 patches the issue.

AnalysisAI

OpenEMR contains a missing authorization check in the signature retrieval endpoint (portal/sign/lib/show-signature.php) that allows any authenticated patient portal user to access the drawn signature images of arbitrary staff members by manipulating the POST parameter. Versions prior to 8.0.0.3 are affected, and while the companion write endpoint was previously hardened against this issue, the read endpoint was left vulnerable. This is a low-severity information disclosure vulnerability (CVSS 4.3) with limited real-world exploitability due to the requirement for prior authentication and the relatively low sensitivity of signature images compared to full medical records.

Technical ContextAI

The vulnerability exists in OpenEMR, a PHP-based electronic health records and medical practice management system. The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), where the application fails to validate that the authenticated user has permission to access signature resources belonging to other users. The vulnerable code path involves the show-signature.php script accepting a user parameter in the POST request body without verifying that the requesting patient portal user is authorized to view that specific staff member's signature. The companion save-signature.php endpoint was previously patched to implement proper authorization controls, establishing a pattern that was inconsistently applied across the codebase. This is a classic horizontal privilege escalation issue within an authenticated context.

RemediationAI

Immediately upgrade OpenEMR to version 8.0.0.3 or later, which includes the authorization check fix implemented in commit ae7ee1872d2e6300b165e24687cc90cf6847a4e5 (available at https://github.com/openemr/openemr/commit/ae7ee1872d2e6300b165e24687cc90cf6847a4e5). Until patching is possible, implement network-level access controls restricting patient portal access to trusted networks only, and review access logs for suspicious signature retrieval patterns (multiple user parameters from single patient accounts). Additionally, audit recent activity logs to determine if the vulnerability was exploited in your environment. The write endpoint (save-signature.php) should already be hardened, so focus remediation efforts on the read endpoint (show-signature.php) in the portal/sign/lib/ directory.