PT-2026-21974 · Openemr · Openemr

Simecek · Published 2026-02-25 · Updated 2026-02-27 · CVE-2026-24908

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0

Description OpenEMR is an electronic health records and medical practice management application. A flaw exists in the Patient REST API endpoint where an authenticated user with API access can execute arbitrary SQL queries through the sort parameter. This is due to insufficient validation of user-supplied input used in SQL ORDER BY clauses. Successful exploitation could lead to database access, exposure of Protected Health Information (PHI), and compromise of credentials.

Recommendations Update to version 8.0.0 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-24908

GHSA-RCC2-45V3-QMQM

Affected Products

Openemr

References · 8

• 🔥 https://github.com/openemr/openemr/security/advisories/GHSA-rcc2-45v3-qmqm · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24908.json · Exploit
• https://github.com/openemr/openemr/commit/943e23cad6e979f87cdf168807fce2a7b32dd194 · Patch
• https://osv.dev/vulnerability/CVE-2026-24908 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24908 · Security Note
• https://twitter.com/CVEnew/status/2027099307284058592 · Twitter Post
• https://t.me/cveNotify/153500 · Telegram Post
• https://twitter.com/CveTodo/status/2026750154527637682 · Twitter Post