PT-2025-23187 · Openmrs · Openmrs-Module-Fhir2

Gracepotmap · Published 2025-05-29 · Updated 2025-05-29 · CVE-2025-46823

Positive Technologies (AI Summary)

CVSS v4.0

8.0

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions openmrs-module-fhir2 versions prior to 2.5.0

Description The issue concerns the openmrs-module-fhir2, which provides the FHIR REST API and related services for OpenMRS, an open medical records system. In versions prior to 2.5.0, privileges were not always correctly checked, allowing unauthorized users to potentially add or edit data they were not supposed to access.

Recommendations For openmrs-module-fhir2 versions prior to 2.5.0, update to FHIR2 2.5.0 or newer as soon as feasible to receive a patch.

Exploit

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-46823

GHSA-G5VQ-W8V2-4X9J

Affected Products

Openmrs-Module-Fhir2

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46823.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-46823 · Security Note
• https://osv.dev/vulnerability/CVE-2025-46823 · Vendor Advisory
• https://github.com/openmrs/openmrs-module-fhir2/security/advisories/GHSA-g5vq-w8v2-4x9j · Note
• https://github.com/openmrs/openmrs-module-fhir2/releases/tag/2.5.0 · Note
• https://github.com/openmrs/openmrs-module-fhir2 · Note
• https://t.me/latest_high_impact_cve/2491 · Telegram Post
• https://twitter.com/CVEnew/status/1928154645689446558 · Twitter Post
• https://t.me/cvetracker/24919 · Telegram Post