OpenEMR CVE-2026-40509

The victim must be an authenticated OpenEMR user with 'Patients - Documents' ACL permissions, and must click a crafted URL or visit an attacker-controlled page while their session is active - passive user interaction (UI:P per CVSS 4.0) is a hard prerequisite. The attacker requires no privileges on the OpenEMR instance. Exploitation is limited to state-changing actions reachable via GET requests; the CVSS vector confirms no confidentiality impact (VC:N), meaning direct patient data exfiltration is not achievable through this vector alone. Non-default conditions limiting exploitation: the victim must hold a specific ACL role ('Patients - Documents'), must be actively authenticated at the time of the crafted request, and must interact with the malicious link; unauthenticated users or those lacking the permission are not viable targets.

The CVSS 4.0 score of 5.3 (Medium) accurately reflects the realistic threat model. The attack vector is network-based (AV:N) with low complexity (AC:L) and requires no attacker privileges (PR:N), but passive victim interaction is mandatory (UI:P) - the authenticated target must click a crafted link or visit an attacker-controlled page during an active session. The impact is constrained to low integrity (VI:L) and excludes confidentiality (VC:N) and availability (VA:N), consistent with the described outcome of forced logout and state changes rather than data exfiltration. No EPSS score was provided in the input data, so probabilistic exploitation likelihood is unknown. The CVE does not appear in the CISA KEV catalog and no public exploit has been identified, indicating no confirmed opportunistic or widespread exploitation at time of analysis. The practical attack surface is further narrowed by the permission prerequisite - only users with 'Patients - Documents' ACL are viable targets. For healthcare organizations, the sensitivity of the environment elevates the priority of patching despite the moderate CVSS score; CSRF in EHR workflows can enable manipulation of patient-related actions beyond simple logout.

An attacker emails a crafted link embedding a malicious web_path value to a clinic's medical records staff member who holds 'Patients - Documents' permissions. When the victim clicks the link while their OpenEMR session is active, the browser silently issues authenticated GET requests to an arbitrary OpenEMR endpoint encoded in web_path, executing actions such as a forced logout or triggering other state-changing operations without the user's knowledge. No public proof-of-concept exploit has been identified at time of analysis.