OpenEMR EUVD-2026-52349

Exploitation requires the attacker to hold a valid, authenticated OpenEMR administrator account (PR:H per CVSS 4.0) - this is the primary limiting condition, restricting the attacker pool to insiders or accounts compromised through a separate initial access vector. The attacker must have write access to the patient portal template management feature specifically; if this feature is disabled or role-restricted below full admin, exploitation is blocked. A victim user (admin, clinician, or portal patient) must load or preview the poisoned template in their browser (UI:P), which is a routine application workflow rather than a contrived action. The cookie exfiltration path further requires that OpenEMR session cookies lack the HttpOnly attribute - described as a confirmed condition in this vulnerability, but independently verifiable in the target deployment. No special network position is required; the application must simply be network-accessible (AV:N). What limits exploitation: valid admin credentials required; victim must actively access the poisoned template; HttpOnly enforcement on cookies would block the specific session-theft chain described (though XSS payload execution would still occur).

The CVSS 4.0 score of 4.8 (AV:N/AC:L/AT:N/PR:H/UI:P/SC:L/SI:L) accurately captures the constrained attack surface: exploitation requires valid administrator credentials (PR:H) and passive victim interaction - a user must load the poisoned template (UI:P). These two requirements meaningfully limit opportunistic mass exploitation. However, the real-world impact in a healthcare context exceeds what the numeric score conveys: OpenEMR stores protected health information (PHI), and a hijacked clinician or administrator session provides unauthorized access to patient records, prescriptions, and billing data - a HIPAA-reportable breach. The PR:H prerequisite presupposes insider threat or a separately compromised admin account, both realistic in healthcare environments. No EPSS score was provided in the input data. Active exploitation is not confirmed in CISA KEV, but a public researcher writeup and VulnCheck-confirmed POC meaningfully lower exploitation effort for targeted attacks. The missing HttpOnly cookie attribute is a compounding misconfiguration that amplifies the XSS impact - without it, the cookie theft chain can be severed as a compensating control even if payload execution occurs.

A malicious or compromised OpenEMR administrator navigates to the patient portal template editor, saves a template containing a JavaScript payload that reads document.cookie and transmits the value via an out-of-band HTTP request to an attacker-controlled server. Any clinician, admin, or portal patient who subsequently loads or previews the poisoned template executes the script silently in their browser, with their session token captured and replayed by the attacker to assume full authenticated access. A step-by-step public proof-of-concept is available at jivasecurity.com, making this technique accessible to non-specialist attackers against confirmed vulnerable instances.