PT-2026-22836 · Openemr · Openemr

Firehed · Publicado 2026-03-03 · Atualizado 2026-03-04 · CVE-2026-25146

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions 5.0.2 through 8.0.0

Description OpenEMR is an electronic health records and medical practice management application. Versions between 5.0.2 and before 8.0.0 have paths where the gateway api key secret value is rendered to the client in plaintext. Exposure of these secret keys could lead to unauthorized money movement or account takeover of payment gateway APIs. The gateway api key is a sensitive variable used for accessing payment gateway APIs.

Recommendations Update to OpenEMR version 8.0.0.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2026-25146

GHSA-2HQ8-WC73-JVVQ

Produtos afetados

Openemr

Referências · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25146.json · Exploit
• https://github.com/openemr/openemr/commit/fe6341496dc82d5b4f5a3f35891bb2e2481f3b25 · Correção
• https://github.com/openemr/openemr/blob/6a4e18c5ec73e0c755f6f65b28a9652aded1a58b/portal/portal_payment.php#L537 · Nota
• https://github.com/openemr/openemr/security/advisories/GHSA-2hq8-wc73-jvvq · Aviso do Fabricante
• https://github.com/openemr/openemr/blob/6a4e18c5ec73e0c755f6f65b28a9652aded1a58b/interface/patient_file/front_payment.php#L765 · Nota
• https://twitter.com/infoflowcloud/status/2028975432163369270 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2028974441045078302 · Publicação no Twitter
• https://t.me/cveNotify/154169 · Publicação no Telegram
• https://twitter.com/CveFindCom/status/2028964049216557099 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2029105971994267709 · Publicação no Twitter
• https://t.me/cveNotify/154223 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-25146 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-25146 · Nota de Segurança
• https://t.me/CVEtracker/46244 · Publicação no Telegram
• https://twitter.com/TheHackerWire/status/2029108943667229177 · Publicação no Twitter