EUVD-2026-13152Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
4DescriptionGitHub Advisory
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the encounter vitals API accepts an id in the request body and treats it as an UPDATE. There is no verification that the vital belongs to the current patient or encounter. An authenticated user with encounters/notes permission can overwrite any patient's vitals by supplying another patient's vital id, leading to medical record tampering. Version 8.0.0.2 fixes the issue.
AnalysisAI
OpenEMR versions prior to 8.0.0.2 contain an authorization bypass vulnerability in the encounter vitals API that allows authenticated users with encounters/notes permissions to overwrite any patient's vital signs by supplying another patient's vital ID in the request body. This constitutes medical record tampering with integrity implications rated CVSS 6.5. No evidence of active exploitation in KEV or public POC availability was identified in the provided intelligence, though the vulnerability is straightforward to exploit given valid API credentials.
Technical ContextAI
The vulnerability resides in OpenEMR's encounter vitals API endpoint (cpe:2.3:a:openemr:openemr:*:*:*:*:*:*:*:*), which processes HTTP requests containing a vital record ID parameter. The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), representing a horizontal privilege escalation flaw where the application fails to validate ownership of resources before permitting modification. The API accepts an 'id' field in the request body and directly uses it to update vital records without confirming the vital belongs to the current patient or encounter context, violating the principle of least privilege and proper access control verification.
RemediationAI
Upgrade OpenEMR immediately to version 8.0.0.2 or later as the primary remediation. Administrators should apply the patch from https://github.com/openemr/openemr/security/advisories/GHSA-mv9m-j65p-g55f and verify the upstream commit c3a47c37619cdb4f0aaa168e39a93ab1d106429c is present. As an interim compensating control before patching, restrict API access to the vital records endpoint through network segmentation or API gateway rules limiting access to trusted clinical workstations only, and audit access logs for anomalous cross-patient vital record modifications. Implement monitoring on vital record changes to detect tampering attempts targeting patients outside the user's assigned care team.
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to
Unauthenticated token disclosure in OpenEMR before 8.0.0. CVSS 10.0. PoC and patch available.
Path traversal in OpenEMR 7.0.4 disposeDocument() allows file access. PoC available.
Path traversal in OpenEMR electronic health records before fix allows authenticated users to read arbitrary files on the
SQL injection in OpenEMR electronic health records before fix. Authenticated users can execute arbitrary SQL through the
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.cl
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid par
Information disclosure in OpenEMR 5.0.2 to before 8.0.0 exposes sensitive data. PoC and patch available.
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shel
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote
OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today