PT-2026-21983 · Openemr · Openemr

Simecek · Publicado 2026-02-25 · Atualizado 2026-02-26 · CVE-2026-25929

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0

Description OpenEMR is an electronic health records and medical practice management application. Before version 8.0.0, the patient picture context in the document controller did not verify user authorization when serving patient photos by document ID or patient ID. This allowed an authenticated user with document access control to retrieve photos of other patients by supplying their ID. The vulnerable component is the document controller’s patient picture context. The affected parameter is the patient ID.

Recommendations Update to version 8.0.0 or later.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-25929

GHSA-778W-R8RM-8QHQ

Produtos afetados

Openemr

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25929.json · Exploit
• https://github.com/openemr/openemr/commit/fc4d00ecb63561dacd23cb1fed49c64bd1a83258 · Correção
• https://github.com/openemr/openemr/security/advisories/GHSA-778w-r8rm-8qhq · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-25929 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2027099300627730936 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-25929 · Nota de Segurança