CVE-2026-25927 - Vulnerability Analysis

Overview

OpenEMR < 8.0.0 contains a broken access control vulnerability caused by lack of verification of document ownership in the DICOM viewer state API, letting authenticated users read or modify any document's viewer state by enumerating document IDs.

Severity & Score

Impact

Authenticated users can read or modify DICOM viewer state for any document, potentially exposing or altering sensitive medical data.

Mitigation

Update to version 8.0.0 or later.

References

• https://github.com/openemr/openemr/security/advisories/GHSA-qj9f-x7v2-hrr7

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner