PT-2026-21973 · Openemr · Openemr

Simecek · CVE-2026-24890 · Publicado 2026-02-25 · Atualizado 2026-02-27

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0

Description OpenEMR is an electronic health records and medical practice management application. An authorization bypass in the patient portal signature endpoint allows authenticated portal users to upload and overwrite provider signatures. This is achieved by setting the type parameter to admin-signature and specifying any provider user ID. This could lead to signature forgery on medical documents, legal compliance violations, and fraud. The issue occurs because portal users are allowed to modify provider signatures without proper authorization checks. The vulnerable parameter is type.

Recommendations Update to version 8.0.0 or later.

Exploit

Correção

Improper Authorization

Enumeração de Fraquezas

CWE-285

Identificadores relacionados

CVE-2026-24890

GHSA-XC8X-MFH8-9XVH

Produtos afetados

Openemr

Referências · 8

• 🔥 https://github.com/openemr/openemr/security/advisories/GHSA-xc8x-mfh8-9xvh · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24890.json · Exploit
• https://github.com/openemr/openemr/commit/a29c0f7ac0975429a85cd09a3ff12ee0dcdb4478 · Correção
• https://t.me/cveNotify/153499 · Publicação no Telegram
• https://twitter.com/CveTodo/status/2026748590899560543 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-24890 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2027099308081000725 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-24890 · Nota de Segurança