PT-2026-21975 · Openemr · Openemr

Simecek · Published 2026-02-25 · Updated 2026-02-27 · CVE-2026-25164

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0

Description OpenEMR is an electronic health records and medical practice management application. Prior to version 8.0.0, the REST API route table in apis/routes/ rest routes standard.inc.php does not call RestConfig::request authorization check() for document and insurance routes. This allows any valid API bearer token to access or modify patient documents and insurance data, regardless of assigned permissions, potentially exposing Protected Health Information (PHI). The vulnerable routes do not perform appropriate access control verification. The RestConfig::request authorization check() function is not invoked for specific API endpoints.

Recommendations Versions prior to 8.0.0 should be updated to version 8.0.0 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-25164

GHSA-F64C-H2GH-G3F9

Affected Products

Openemr

References · 8

• 🔥 https://github.com/openemr/openemr/security/advisories/GHSA-f64c-h2gh-g3f9 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25164.json · Exploit
• https://github.com/openemr/openemr/commit/c5e1c44774156cd0d04f4e08ed6a81fe76d38e92 · Patch
• https://osv.dev/vulnerability/CVE-2026-25164 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25164 · Security Note
• https://t.me/cveNotify/153501 · Telegram Post
• https://twitter.com/CveTodo/status/2026749630000542129 · Twitter Post
• https://twitter.com/CVEnew/status/2027099306420040139 · Twitter Post