PT-2026-21826 · Openemr · Openemr

Heshamm1 · Publicado 2026-02-25 · Atualizado 2026-02-25 · CVE-2026-25124

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0

Description OpenEMR is an electronic health records and medical practice management application. Versions of the application prior to 8.0.0 contain an access control flaw. This flaw allows users with limited privileges, such as receptionists, to export a complete message list that includes sensitive patient and user data. The issue is located in the message list.php report export functionality, which lacks proper permission checks before executing database queries. The existing CSRF token verification is insufficient to prevent unauthorized data access if the token is compromised.

Recommendations Update to version 8.0.0 or later.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-25124

GHSA-Q7P5-RRWJ-QMP2

Produtos afetados

Openemr

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25124.json · Exploit
• https://github.com/openemr/openemr/commit/ad902d6892482fff2e3c56bfb15597df8b6c3beb · Correção
• https://github.com/openemr/openemr/security/advisories/GHSA-q7p5-rrwj-qmp2 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2026614613949751537 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-25124 · Nota de Segurança
• https://twitter.com/CVEnew/status/2026641384669659644 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-25124 · Aviso do Fabricante