PT-2026-22100 · Openemr · Openemr

Simecek · Published 2026-02-26 · Updated 2026-02-26 · CVE-2026-27943

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions up to and including 8.0.0

Description OpenEMR is an electronic health records and medical practice management application. Versions up to 8.0.0 do not verify that a form belongs to the current user’s patient or encounter context when loading data via the form id parameter in the eye exam (eye mag) view. This allows an authenticated user to access or edit any patient’s eye exam by providing another form ID, and potentially switch the session’s active patient in some flows.

Recommendations Update to a version with the fix available on the main branch of the OpenEMR GitHub repository.

Exploit

Fix

LPE

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-27943

GHSA-Q96X-QW99-6XQ9

Affected Products

Openemr

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27943.json · Exploit
• https://github.com/openemr/openemr/security/advisories/GHSA-q96x-qw99-6xq9 · Vendor Advisory
• https://github.com/openemr/openemr/commit/c87489bf63f2701b634d948279e104f2ed3df1c0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27943 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27943 · Vendor Advisory
• https://twitter.com/CVEnew/status/2027004218775601328 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2026972984775172278 · Twitter Post