CVE-2026-27943 - Vulnerability Analysis

Overview

OpenEMR <= 8.0.0 contains a broken access control vulnerability caused by lack of verification that form_id belongs to the current user's patient context in eye exam view, letting authenticated users access or edit any patient's eye exam, exploit requires authentication.

Severity & Score

Impact

Authenticated users can access or modify any patient's eye exam data, potentially leading to unauthorized data disclosure and modification.

Mitigation

Update to the fixed version available on the main branch of the OpenEMR GitHub repository or later.

References

• https://github.com/openemr/openemr/commit/c87489bf63f2701b634d948279e104f2ed3df1c0
• https://github.com/openemr/openemr/security/advisories/GHSA-q96x-qw99-6xq9

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner