CVE-2026-24890 - Vulnerability Analysis

Overview

OpenEMR < 8.0.0 contains an authorization bypass caused by improper access control in the patient portal signature endpoint, letting authenticated portal users overwrite provider signatures, exploit requires authenticated portal access.

Severity & Score

Impact

Authenticated portal users can forge provider signatures, leading to legal compliance violations and fraud.

Mitigation

Update to version 8.0.0 or later.

References

• https://github.com/openemr/openemr/security/advisories/GHSA-xc8x-mfh8-9xvh
• https://github.com/openemr/openemr/commit/a29c0f7ac0975429a85cd09a3ff12ee0dcdb4478

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 25, 2026

🟠 CVE-2026-24890 - High (8.1) OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an authorization bypass vulnerability in the patient portal signature endpoint allows authenticated portal users to up... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24890/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner