PT-2026-26346 · Openemr · Openemr

Pavelkohout396 + 1 · Published 2026-03-19 · Updated 2026-03-23 · CVE-2026-33304

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0.2

Description OpenEMR is an electronic health records and medical practice management application. A flaw exists where an authenticated, non-administrator user can view reminder messages belonging to other users. This is achieved by manipulating the sentTo[] or sentBy[] parameters in a GET request to the dated reminders log. The issue allows access to patient names and the content of free-text messages.

Recommendations Update to OpenEMR version 8.0.0.2 or later.

Exploit

Fix

IDOR

Missing Authorization

Weakness Enumeration

CWE-639

CWE-862

Related Identifiers

BDU:2026-05092

CVE-2026-33304

GHSA-66J9-FFQ4-H222

Affected Products

Openemr

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33304.json · Exploit
• https://github.com/openemr/openemr/commit/21dee7658a5f3b18c5750e3fae7324e875c1703a · Patch
• https://github.com/openemr/openemr/security/advisories/GHSA-66j9-ffq4-h222 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05092 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33304 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33304 · Vendor Advisory
• https://twitter.com/CVEnew/status/2035992549496672278 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034775016647127537 · Twitter Post
• https://twitter.com/infoflowcloud/status/2035994000843231475 · Twitter Post