CVE-2026-25164 - Vulnerability Analysis

Overview

OpenEMR < 8.0.0 contains a broken access control caused by missing authorization checks in REST API document and insurance routes, letting authenticated API clients access or modify all patients' documents and insurance data, exploit requires valid API bearer token.

Severity & Score

Impact

Authenticated API clients can access or modify all patients' sensitive documents and insurance data, exposing protected health information.

Mitigation

Upgrade to version 8.0.0 or later.

References

• https://github.com/openemr/openemr/commit/c5e1c44774156cd0d04f4e08ed6a81fe76d38e92
• https://github.com/openemr/openemr/security/advisories/GHSA-f64c-h2gh-g3f9

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 25, 2026

🟠 CVE-2026-25164 - High (8.1) OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the REST API route table in `apis/routes/_rest_routes_standard.inc.php` does not call `RestConfig::request_authorizati... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25164/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner