PT-2026-21827 · Openemr · Openemr

Knock-Pt · Published 2026-02-25 · Updated 2026-02-25 · CVE-2026-25127

Positive Technologies · (AI Summary)

CVSS v4.0

7.0

High

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0

Description The application does not properly validate user permissions, allowing unauthorized users to view information belonging to authorized users.

Recommendations Update to version 8.0.0 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-25127

GHSA-69CV-RV28-4G85

Affected Products

Openemr

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25127.json · Exploit
• https://github.com/openemr/openemr/commit/ad902d6892482fff2e3c56bfb15597df8b6c3beb · Patch
• https://github.com/openemr/openemr/security/advisories/GHSA-69cv-rv28-4g85 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25127 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25127 · Security Note
• https://twitter.com/CVEnew/status/2026641383495254426 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2026612053989871817 · Twitter Post