EUVD-2026-12952Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
3DescriptionGitHub Advisory
OpenEMR is a free and open source electronic health records and medical practice management application. In versions up to and including 8.0.0, the message/note update endpoint (e.g. PUT or POST) updates by message/note ID only and does not verify that the message belongs to the current patient (or that the user is allowed to edit that patient’s notes). An authenticated user with notes permission can modify any patient’s messages by supplying another message ID. Commit 92a2ff9eaaa80674b3a934a6556e35e7aded5a41 contains a fix for the issue.
AnalysisAI
OpenEMR versions up to 8.0.0 contain an authorization bypass vulnerability in the message/note update endpoints that allows authenticated users with notes permissions to modify any patient's messages without proper access control verification. An attacker can exploit this by supplying arbitrary message IDs in PUT or POST requests, enabling unauthorized modification of other patients' medical records. This is a moderate-risk issue (CVSS 6.5) with integrity impact on sensitive healthcare data, though exploitation requires existing authentication and notes permissions.
Technical ContextAI
The vulnerability exists in OpenEMR's message/note update API endpoints (affected by CVE-2026-25745, per CPE cpe:2.3:a:openemr:openemr:*:*:*:*:*:*:*:*) and stems from CWE-639 (Authorization Bypass Through User-Controlled Key), a class of flaws where access control decisions rely solely on user-supplied identifiers without validating ownership or context. The endpoints accept PUT or POST requests with message IDs as parameters but fail to verify that the message being updated belongs to the current patient or that the authenticated user has permission to edit that specific patient's records. This represents a classic insecure direct object reference (IDOR) pattern in healthcare software, where business logic authorization is absent despite authentication being in place.
RemediationAI
Organizations running OpenEMR should immediately upgrade to a patched version released after the fix commit 92a2ff9eaaa80674b3a934a6556e35e7aded5a41; verify with the vendor whether this is available as an 8.0.1 patch or requires upgrade to a newer major version. Consult the GitHub security advisory at https://github.com/openemr/openemr/security/advisories/GHSA-jm78-x5p7-52qh for the exact patched version and deployment instructions. As an interim mitigation, restrict notes permission grants to only users who need direct edit capability and implement network-level access controls limiting message API endpoints to trusted internal subnets. Conduct a post-remediation audit of message modification logs to identify any unauthorized changes to patient records during the vulnerability window.
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to
Unauthenticated token disclosure in OpenEMR before 8.0.0. CVSS 10.0. PoC and patch available.
Path traversal in OpenEMR 7.0.4 disposeDocument() allows file access. PoC available.
Path traversal in OpenEMR electronic health records before fix allows authenticated users to read arbitrary files on the
SQL injection in OpenEMR electronic health records before fix. Authenticated users can execute arbitrary SQL through the
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.cl
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid par
Information disclosure in OpenEMR 5.0.2 to before 8.0.0 exposes sensitive data. PoC and patch available.
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shel
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote
OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today