OpenMRS Core CVE-2026-41258

Exploitation requires a valid OpenMRS account with the 'Manage Concepts' privilege, which is explicitly defined in OpenMRS as 'Able to add/edit/delete concept entries' and is typically granted to clinical informatics staff, terminology coordinators, and implementation administrators who maintain the clinical concept dictionary. The privilege is not restricted to system administrators, and vendor documentation indicates multiple facility staff commonly hold this privilege in typical healthcare deployments. The attacker must have network access to the OpenMRS web interface (AV:N from CVSS vector) to authenticate and access concept management functionality. Exploitation does not require any non-default configuration (AC:L) - the vulnerable ConceptReferenceRangeUtility.evaluateCriteria() method is active by default when concept reference ranges are used for clinical validation. No user interaction is required beyond the initial privilege abuse (UI:N). However, practical impact depends on whether the facility actively uses concept reference range criteria for observation validation; if this feature is unused, the vulnerable code path may not execute despite being present. The changed scope (S:C) reflects privilege escalation from concept management to arbitrary code execution as the Tomcat JVM process, transcending the intended security boundary of the 'Manage Concepts' privilege.

CVSS 9.1 (Critical) reflects attack vector network (AV:N), low complexity (AC:L), high privileges required (PR:H), no user interaction (UI:N), and changed scope (S:C) with full confidentiality, integrity, and availability impact. However, real-world risk is significantly nuanced by the privilege prerequisite. The 'Manage Concepts' privilege is described by the vendor as a content-management function for clinical dictionary administration, routinely granted to non-administrative clinical informatics staff at healthcare facilities. This creates a realistic privilege escalation path from clinical data management to full application server compromise. The persistence mechanism (database-stored payload executing on every observation validation) is particularly dangerous in healthcare environments where common clinical measurements trigger frequent automatic validations across all system users and API integrations. Protected Health Information (PHI) exfiltration requires no additional OS-level access since patient data objects are directly exposed in the Velocity context. The CVSS vector's high privilege requirement (PR:H) may understate risk if 'Manage Concepts' is widely distributed within typical OpenMRS deployments. No EPSS score provided, no CISA KEV listing indicates targeted rather than widespread exploitation. Patch availability is confirmed with specific fix versions from vendor GitHub advisory. Attack automation is feasible post-authentication with concept management privilege. SSVC decision: exploitation not confirmed active, automatable within authenticated scope, technical impact total (arbitrary code execution as Tomcat process).

A medical records coordinator with 'Manage Concepts' privilege (granted for maintaining the clinical terminology dictionary) authenticates to the OpenMRS administration interface and navigates to concept management. The attacker creates or modifies a concept for a frequently used laboratory test (e.g., blood glucose measurement) and injects a malicious Velocity template expression into the reference range criteria field, such as a payload that invokes Java Runtime.exec() to establish a reverse shell or exfiltrate the patient database. The payload persists in the concept_reference_range database table. Subsequently, every time any clinician, automated lab interface, or mobile health application validates an observation against this concept, the ConceptReferenceRangeUtility.evaluateCriteria() method automatically executes the injected template as the Tomcat application server process, granting the attacker persistent code execution without further authentication. The attacker can exfiltrate Protected Health Information directly through the exposed $patient and $obs context objects or escalate to full server compromise.