PT-2026-5034 · Openemr · Openemr

CVE-2025-67645 · Publicado 2026-01-27 · Atualizado 2026-02-12

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 7.0.4

Description OpenEMR is an electronic health records and medical practice management application. A broken access control exists in the Profile Edit endpoint. An authenticated user can modify request parameters (pubpid / pid) to reference another user’s record. The server accepts these modified IDs and applies changes to the other user’s profile, allowing alteration of profile data like name and contact information, potentially leading to account takeover. The affected API endpoint is the Profile Edit endpoint.

Recommendations Update to version 7.0.4 or later.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2025-67645

GHSA-VJMV-CF46-GFFV

Produtos afetados

Openemr

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67645.json · Exploit
• https://github.com/openemr/openemr/security/advisories/GHSA-vjmv-cf46-gffv · Aviso do Fabricante
• https://github.com/openemr/openemr/commit/e2a682ee71aac71a9f04ae566f4ffca10052bc4a · Correção
• https://twitter.com/cracbot/status/2018278266851958829 · Publicação no Twitter
• https://twitter.com/pulsepatchio/status/2016525753161302206 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2016340731510530116 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2016296316025110930 · Publicação no Twitter
• https://t.me/cveNotify/151880 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-67645 · Nota de Segurança
• https://t.me/cveNotify/150056 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-67645 · Aviso do Fabricante