PT-2026-21984 · Openemr · Openemr

Simecek · Published 2026-02-25 · Updated 2026-02-26 · CVE-2026-25930

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0

Description OpenEMR is an electronic health records and medical practice management application. Versions prior to 8.0.0 do not properly verify user authorization when accessing Layout-Based Form (LBF) printable views. Specifically, the application accepts formid and visitid (or patientid) from requests without confirming the form belongs to the currently authenticated user’s authorized patient or encounter. This allows an authenticated user with LBF access to enumerate form IDs and potentially view or print encounter forms for any patient. The application uses the formid and visitid (or patientid) parameters in the request to access the forms.

Recommendations Update to version 8.0.0 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-25930

GHSA-H3XX-8CP7-HF7M

Affected Products

Openemr

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25930.json · Exploit
• https://github.com/openemr/openemr/commit/8c76acdd226007cc4ff3eccd3ca6193e0be6e699 · Patch
• https://github.com/openemr/openemr/security/advisories/GHSA-h3xx-8cp7-hf7m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25930 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25930 · Security Note
• https://twitter.com/CVEnew/status/2027099299826545060 · Twitter Post