PT-2026-21984 · Openemr · Openemr

Simecek · Publicado 2026-02-25 · Atualizado 2026-02-26 · CVE-2026-25930

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0

Description OpenEMR is an electronic health records and medical practice management application. Versions prior to 8.0.0 do not properly verify user authorization when accessing Layout-Based Form (LBF) printable views. Specifically, the application accepts formid and visitid (or patientid) from requests without confirming the form belongs to the currently authenticated user’s authorized patient or encounter. This allows an authenticated user with LBF access to enumerate form IDs and potentially view or print encounter forms for any patient. The application uses the formid and visitid (or patientid) parameters in the request to access the forms.

Recommendations Update to version 8.0.0 or later.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-25930

GHSA-H3XX-8CP7-HF7M

Produtos afetados

Openemr

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25930.json · Exploit
• https://github.com/openemr/openemr/commit/8c76acdd226007cc4ff3eccd3ca6193e0be6e699 · Correção
• https://github.com/openemr/openemr/security/advisories/GHSA-h3xx-8cp7-hf7m · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-25930 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-25930 · Nota de Segurança
• https://twitter.com/CVEnew/status/2027099299826545060 · Publicação no Twitter