PT-2026-22100 · Openemr · Openemr

Simecek · Publicado 2026-02-26 · Atualizado 2026-02-26 · CVE-2026-27943

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions up to and including 8.0.0

Description OpenEMR is an electronic health records and medical practice management application. Versions up to 8.0.0 do not verify that a form belongs to the current user’s patient or encounter context when loading data via the form id parameter in the eye exam (eye mag) view. This allows an authenticated user to access or edit any patient’s eye exam by providing another form ID, and potentially switch the session’s active patient in some flows.

Recommendations Update to a version with the fix available on the main branch of the OpenEMR GitHub repository.

Exploit

Correção

LPE

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-27943

GHSA-Q96X-QW99-6XQ9

Produtos afetados

Openemr

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27943.json · Exploit
• https://github.com/openemr/openemr/security/advisories/GHSA-q96x-qw99-6xq9 · Aviso do Fabricante
• https://github.com/openemr/openemr/commit/c87489bf63f2701b634d948279e104f2ed3df1c0 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-27943 · Nota de Segurança
• https://twitter.com/CVEnew/status/2027004218775601328 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2026972984775172278 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-27943 · Aviso do Fabricante