PT-2026-26151 · Openemr · Openemr

Simecek · Publicado 2026-03-18 · Atualizado 2026-03-19 · CVE-2026-25745

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions up to and including 8.0.0

Description OpenEMR is an electronic health records and medical practice management application. In versions up to and including 8.0.0, the message/note update endpoint does not verify that the message belongs to the current patient or that the user is authorized to edit the patient’s notes. An authenticated user with notes permission can modify any patient’s messages by providing another message ID. The vulnerable endpoint is a PUT or POST request to the message/note update endpoint. The vulnerable parameter is the message/note ID. Commit 92a2ff9eaaa80674b3a934a6556e35e7aded5a41 contains a fix for the issue.

Recommendations Update to a version later than 8.0.0.

Exploit

Correção

LPE

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-25745

GHSA-JM78-X5P7-52QH

Produtos afetados

Openemr

Referências · 7

• 🔥 https://github.com/openemr/openemr/security/advisories/GHSA-jm78-x5p7-52qh · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25745.json · Exploit
• https://github.com/openemr/openemr/commit/92a2ff9eaaa80674b3a934a6556e35e7aded5a41 · Correção
• https://osv.dev/vulnerability/CVE-2026-25745 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-25745 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2034437124682891309 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2034520430527098923 · Publicação no Twitter