Openemr EUVD-2026-12952

The CVSS 6.5 score reflects a medium severity vulnerability with network-accessible attack vector (AV:N), low attack complexity (AC:L), and low privilege requirements (PR:L, requiring authenticated user with notes permission). The primary concern is integrity impact (I:H) with no confidentiality or availability impact. While the CVSS is moderate, real-world risk is elevated in healthcare contexts because: (1) OpenEMR is widely deployed in smaller clinics and practices with limited security staff, (2) the attack is trivially automatable (no user interaction required, UI:N), (3) any staff member with notes permissions can exploit it, and (4) modification of patient medical records carries high regulatory and liability risk under HIPAA and state medical privacy laws. The existence of a public GitHub advisory and patched commit (92a2ff9eaaa80674b3a934a6556e35e7aded5a41) indicates vendor has confirmed and remediated the issue. Without EPSS or KEV data provided, this should be prioritized based on deployment prevalence; healthcare organizations running OpenEMR should treat this as high priority for remediation despite the moderate CVSS score.

An authenticated clinic staff member (e.g., medical assistant with notes permissions) discovers that patient messages are accessible via sequential or predictable IDs in the API. The attacker crafts a PUT request to the message update endpoint with another patient's message ID, modifying the medical note content without the target patient's or authorized provider's knowledge. Because the endpoint lacks patient context verification, the request succeeds, allowing the attacker to alter diagnoses, medication records, or clinical notes for any patient in the system. This could be automated to target multiple patients, and the low attack complexity (simple HTTP requests) means even unsophisticated attackers can exploit it.