Openemr EUVD-2026-13152

The CVSS 6.5 score reflects medium severity with network accessibility (AV:N), low attack complexity (AC:L), and required low-privileged authentication (PR:L), but the integrity impact is high (I:H) and confidentiality/availability are not affected. The critical distinction is that this vulnerability requires prior authentication, significantly reducing real-world exploitability compared to unauthenticated flaws. However, the attack is non-interactive (UI:N), automatable, and carries high technical impact on data integrity—a core concern in healthcare contexts where medical record tampering can directly affect patient safety. The lack of reported active exploitation or public POC suggests this remains largely theoretical, though healthcare organizations are high-value targets. The availability of a patch (8.0.0.2) in the vendor repository reduces urgency slightly but does not diminish the need for timely deployment in clinical environments.

A healthcare administrative user with valid encounters/notes permissions authenticates to the OpenEMR web interface or API. The attacker discovers the vital record ID of a patient they do not have authorization to modify (e.g., via previous API reconnaissance or information disclosure). The attacker crafts an HTTP request to the encounter vitals endpoint, submitting the target patient's vital ID with modified values (e.g., falsified blood pressure, heart rate). The API processes the request without verifying ownership, and the victim patient's medical record is silently corrupted with false vital signs, potentially affecting clinical decision-making if the records are reviewed before detection.