EUVD-2026-13225Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionGitHub Advisory
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, an authorization bypass in the dated reminders log allows any authenticated non-admin user to view reminder messages belonging to other users, including associated patient names and free-text message content, by crafting a GET request with arbitrary user IDs in the sentTo[] or sentBy[] parameters. Version 8.0.0.2 fixes the issue.
AnalysisAI
An authorization bypass vulnerability in OpenEMR versions prior to 8.0.0.2 allows authenticated non-administrator users to access reminder messages and associated patient information belonging to other users by manipulating GET request parameters. Any authenticated user can view sensitive data including patient names and message content from arbitrary user accounts without proper authorization checks. This vulnerability has a CVSS score of 6.5 (Medium) with high confidentiality impact but no integrity or availability impact, and a proof-of-concept has been published via the GitHub security advisory.
Technical ContextAI
OpenEMR is an open-source electronic health records (EHR) and medical practice management system (cpe:2.3:a:openemr:openemr:*:*:*:*:*:*:*:*). The vulnerability exists in the dated reminders log functionality, which fails to implement proper authorization controls on reminder message retrieval. The root cause is classified under CWE-639 (Authorization Bypass Through User-Controlled Key), indicating that the application uses user-supplied input (sentTo[] and sentBy[] parameters) to query reminder data without validating whether the requesting user has permission to access those specific records. This is a classic horizontal privilege escalation flaw where access controls fail to enforce row-level security based on user identity or role.
RemediationAI
Immediately upgrade OpenEMR to version 8.0.0.2 or later. Organizations unable to patch immediately should implement network-level access controls to restrict the OpenEMR application to trusted user groups and enable comprehensive audit logging of all reminder log access. Database-level row-level security (RLS) policies can provide temporary mitigation by enforcing that users can only query reminder records associated with their own user ID. Additionally, implement real-time alerting on bulk parameter enumeration attempts targeting the sentTo[] and sentBy[] parameters, and review access logs for unauthorized cross-user reminder queries. The vendor patch is available through the official GitHub repository at https://github.com/openemr/openemr/releases and should be deployed without delay in healthcare environments due to HIPAA implications.
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to
Unauthenticated token disclosure in OpenEMR before 8.0.0. CVSS 10.0. PoC and patch available.
Path traversal in OpenEMR 7.0.4 disposeDocument() allows file access. PoC available.
Path traversal in OpenEMR electronic health records before fix allows authenticated users to read arbitrary files on the
SQL injection in OpenEMR electronic health records before fix. Authenticated users can execute arbitrary SQL through the
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.cl
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid par
Information disclosure in OpenEMR 5.0.2 to before 8.0.0 exposes sensitive data. PoC and patch available.
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shel
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote
OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today