CVE-2026-25930 - Vulnerability Analysis

Overview

OpenEMR < 8.0.0 contains a broken access control caused by lack of verification that form belongs to authorized patient in Layout-Based Form printable view, letting authenticated users with LBF access view or print any patient's encounter forms, exploit requires user authentication with LBF access.

Severity & Score

Impact

Authenticated users can access and print any patient's encounter forms, leading to unauthorized disclosure of sensitive medical information.

Mitigation

Update to version 8.0.0 or later.

References

• https://github.com/openemr/openemr/commit/8c76acdd226007cc4ff3eccd3ca6193e0be6e699
• https://github.com/openemr/openemr/security/advisories/GHSA-h3xx-8cp7-hf7m

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner