Openemr CVE-2026-33934

The CVSS score of 4.3 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N indicates a low-severity vulnerability with network accessibility but requiring low privileges (authenticated patient user). The attack has low complexity and no user interaction required, which are positive indicators for exploitability. However, the impact is limited to confidentiality with no integrity or availability impact, and the scope remains unchanged. The real-world risk is further mitigated by the fact that signature images alone represent limited sensitive information compared to full patient medical records or staff credentials. Without explicit EPSS score data or confirmed KEV status provided, the vulnerability appears to be a typical authorization bypass in a healthcare system that requires authentication as a precondition, making it less severe than unauthenticated access scenarios. The existence of a clear patch (version 8.0.0.3) and the fact that the write endpoint was previously hardened suggests the development team has recognized and addressed similar patterns.

An authenticated patient portal user logs in and manipulates the POST request to show-signature.php by changing the user parameter to target a staff member's signature image, retrieving sensitive signature data without proper authorization. Since the attack requires low complexity and no user interaction beyond the initial manipulation of the POST body, an attacker could automate this process to enumerate and collect signatures from multiple staff members across the healthcare organization. The attack is particularly concerning in healthcare settings where staff signatures may be used for document authentication or verification purposes, though the direct impact remains information disclosure rather than system compromise.