PT-2026-21975 · Openemr · Openemr

Simecek · Publicado 2026-02-25 · Atualizado 2026-02-27 · CVE-2026-25164

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0

Description OpenEMR is an electronic health records and medical practice management application. Prior to version 8.0.0, the REST API route table in apis/routes/ rest routes standard.inc.php does not call RestConfig::request authorization check() for document and insurance routes. This allows any valid API bearer token to access or modify patient documents and insurance data, regardless of assigned permissions, potentially exposing Protected Health Information (PHI). The vulnerable routes do not perform appropriate access control verification. The RestConfig::request authorization check() function is not invoked for specific API endpoints.

Recommendations Versions prior to 8.0.0 should be updated to version 8.0.0 or later.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-25164

GHSA-F64C-H2GH-G3F9

Produtos afetados

Openemr

Referências · 8

• 🔥 https://github.com/openemr/openemr/security/advisories/GHSA-f64c-h2gh-g3f9 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25164.json · Exploit
• https://github.com/openemr/openemr/commit/c5e1c44774156cd0d04f4e08ed6a81fe76d38e92 · Correção
• https://osv.dev/vulnerability/CVE-2026-25164 · Aviso do Fabricante
• https://t.me/cveNotify/153501 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-25164 · Nota de Segurança
• https://twitter.com/CveTodo/status/2026749630000542129 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2027099306420040139 · Publicação no Twitter