PT-2026-28148 · Openemr · Openemr

CVE-2026-33931 · Publicado 2026-03-25 · Atualizado 2026-03-26

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0.3

Description OpenEMR is an electronic health records and medical practice management application. A flaw exists where an authenticated portal patient can access other patients' payment records, including invoice/billing data and payment card metadata, by manipulating the recid query parameter in the portal/portal payment.php file. This is due to an Insecure Direct Object Reference (IDOR) condition. The vulnerable parameter is recid.

Recommendations Update to version 8.0.0.3 or later.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-33931

GHSA-HF37-5RP9-J27J

Produtos afetados

Openemr

Referências · 7

• 🔥 https://github.com/openemr/openemr/security/advisories/GHSA-hf37-5rp9-j27j · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33931.json · Exploit
• https://github.com/openemr/openemr/commit/7bf30e0ec5587f80c19094d58df09d46ac328806 · Correção
• https://github.com/openemr/openemr/releases/tag/v8_0_0_3 · Nota
• https://osv.dev/vulnerability/CVE-2026-33931 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33931 · Nota de Segurança
• https://twitter.com/CVEnew/status/2037137780686434317 · Publicação no Twitter