SB2026091415 - Multiple vulnerabilities in OpenEMR

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026091415

SB2026091415 - Multiple vulnerabilities in OpenEMR

Published: September 14, 2026

Security Bulletin ID SB2026091415
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper neutralization of special elements used in an SQL command in the OnsiteDocument Query API when processing user-supplied query parameters. A remote user can send a specially crafted query parameter to disclose sensitive information.

Database error responses expose exception messages and stack traces, enabling error-based injection.


2) Insufficient Session Expiration (CVE-ID: N/A)

CWE-ID: CWE-613 - Insufficient Session Expiration

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive patient information and perform patient-facing actions.

The vulnerability exists due to failure to enforce one-time token-use restrictions in the OneTimeAuth token-consumption path in src/Common/Auth/OneTimeAuth.php when submitting a captured service_auth token to the patient portal. A remote attacker can replay a valid token to disclose sensitive patient information and perform patient-facing actions.

For PIN-protected flows, exploitation also requires the associated PIN.


3) Improper Restriction of Excessive Authentication Attempts (CVE-ID: N/A)

CWE-ID: CWE-307 - Improper Restriction of Excessive Authentication Attempts

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive patient information and perform patient-facing actions.

The vulnerability exists due to improper restriction of excessive authentication attempts in the PIN-validation branch of OneTimeAuth.php::processOnetime() when validating login PIN values for an invoice token. A remote attacker can submit repeated PIN guesses with a captured invoice token to disclose sensitive patient information and perform patient-facing actions.

Invoice tokens may remain valid for up to 14 days.


4) Incorrect Comparison (CVE-ID: N/A)

CWE-ID: CWE-697 - Incorrect Comparison

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass PIN verification and disclose patient information.

The vulnerability exists due to improper comparison in OneTimeAuth.php::processOnetime() when validating a submitted login PIN. A remote attacker can submit a crafted numeric representation of a PIN to bypass PIN verification and disclose patient information.

Exploitation requires knowledge of the PIN's numeric value or a side channel indicating that the PIN begins with zero.


5) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive patient information.

The vulnerability exists due to missing authorization in the FHIR Media and QuestionnaireResponse read routes when handling requests for Media or QuestionnaireResponse resources. A remote user can send requests to unprotected FHIR read routes to disclose sensitive patient information.

Exploitation requires a non-patient API token with the relevant FHIR read scope but without the corresponding OpenEMR ACL.


6) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive patient information.

The vulnerability exists due to improper access control in the SMART on FHIR patient binding validation method when processing SMART launch context mapping. A remote user can specify an arbitrary patient UUID in the token context to disclose sensitive patient information.

The validation method unconditionally returns true without verifying the requesting user's relationship to the patient.


Remediation

Install update from vendor's website.

References