CVE-2026-25744 - Vulnerability Analysis

Overview

OpenEMR < 8.0.0.2 contains a broken access control vulnerability caused by lack of verification on vital record ownership in the encounter vitals API, letting authenticated users with encounters/notes permission overwrite any patient's vitals, exploit requires user authentication with encounters/notes permission.

Severity & Score

Impact

Authenticated users can modify any patient's medical vitals, leading to medical record tampering and potential patient care risks.

Mitigation

Upgrade to version 8.0.0.2 or later.

References

• https://github.com/openemr/openemr/commit/c3a47c37619cdb4f0aaa168e39a93ab1d106429c
• https://github.com/openemr/openemr/security/advisories/GHSA-mv9m-j65p-g55f

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner