PT-2026-5033 · Openemr · Openemr

Published 2026-01-27 · Updated 2026-02-12 · CVE-2025-54373

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 7.0.4

Description OpenEMR is an electronic health records and medical practice management application. Versions before 7.0.4 allow users without appropriate privileges to view and modify sensitive information within Clinical Notes and Care Plans when an encounter has a high sensitivity level. The Sensitivity setting determines access control to encounter data.

Recommendations Update to version 7.0.4 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-54373

GHSA-739G-6M63-P7FR

Affected Products

Openemr

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54373.json · Exploit
• https://github.com/openemr/openemr/commit/aef3d1c85d9ff2f28d3d361d2818aee79b6dcd33 · Patch
• https://github.com/openemr/openemr/security/advisories/GHSA-739g-6m63-p7fr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54373 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54373 · Vendor Advisory
• https://t.me/cveNotify/150054 · Telegram Post
• https://t.me/cveNotify/151886 · Telegram Post
• https://twitter.com/CVEnew/status/2016290009243123749 · Twitter Post