PT-2026-28148 · Openemr · Openemr

Published 2026-03-25 · Updated 2026-03-26 · CVE-2026-33931

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0.3

Description OpenEMR is an electronic health records and medical practice management application. A flaw exists where an authenticated portal patient can access other patients' payment records, including invoice/billing data and payment card metadata, by manipulating the recid query parameter in the portal/portal payment.php file. This is due to an Insecure Direct Object Reference (IDOR) condition. The vulnerable parameter is recid.

Recommendations Update to version 8.0.0.3 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-33931

GHSA-HF37-5RP9-J27J

Affected Products

Openemr

References · 7

• 🔥 https://github.com/openemr/openemr/security/advisories/GHSA-hf37-5rp9-j27j · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33931.json · Exploit
• https://github.com/openemr/openemr/commit/7bf30e0ec5587f80c19094d58df09d46ac328806 · Patch
• https://osv.dev/vulnerability/CVE-2026-33931 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33931 · Security Note
• https://github.com/openemr/openemr/releases/tag/v8_0_0_3 · Note
• https://twitter.com/CVEnew/status/2037137780686434317 · Twitter Post