CVE-2026-25745 - Vulnerability Analysis

Overview

OpenEMR <= 8.0.0 contains a broken access control caused by lack of verification on message/note ownership in the update endpoint, letting authenticated users with notes permission modify any patient's messages, exploit requires user authentication with notes permission.

Severity & Score

Impact

Authenticated users with notes permission can modify any patient's messages, risking data integrity and patient confidentiality.

Mitigation

Update to a version including commit 92a2ff9eaaa80674b3a934a6556e35e7aded5a41 or later.

References

• https://github.com/openemr/openemr/commit/92a2ff9eaaa80674b3a934a6556e35e7aded5a41
• https://github.com/openemr/openemr/security/advisories/GHSA-jm78-x5p7-52qh

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner