SB2026110356 - Multiple vulnerabilities in OpenEMR

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110356

SB2026110356 - Multiple vulnerabilities in OpenEMR

Published: November 3, 2026

Security Bulletin ID SB2026110356
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 36
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 22% Low 78%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 36 vulnerabilities.


1) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive patient information without the required patient-document or clinical-data permissions.

The vulnerability exists due to improper access control in OpenEMR's portal/lib/download_template.php and DocumentTemplateRender service when rendering document templates for a supplied patient ID. A remote user can submit a POST request with isModule=1, an arbitrary pid, and an installed template_id to bypass patient authorization checks and disclose the target patient's information through the template's patient directives.

The stock Privacy Document discloses identity, date of birth, and chart ID; exposure of additional clinical and contact fields depends on the installed templates.


2) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive database information, take over patient-portal accounts when active reset values exist, corrupt global C-CDA mappings, and degrade application availability.

The vulnerability exists due to improper neutralization of stored field identifiers in Carecoordination/Model/EncounterccdadispatchTable.php::fetchFormValues() when generating a mapped patient's C-CDA document. A remote user can submit a crafted field identifier through the Carecoordination setup savedata action, which persists it for later concatenation into an SQL IN (...) clause, to execute second-order SQL injection and extract patient records, staff password hashes, portal reset values, OAuth records, and configuration data, or execute repeated delay expressions to degrade availability.

Exploitation requires Carecoordination and C-CDA generation to be enabled.


3) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to transmit arbitrary queued laboratory orders without write permission and alter their transmission state, disrupting laboratory workflows.

The vulnerability exists due to improper access control in OpenEMR's interface/orders/list_reports.php when handling laboratory-order transmission requests. A remote user can submit a POST request with form_xmit and selected procedure-order IDs in form_cb using read-only medical-record permission to transmit orders without write authorization or patient-level authorization checks and mark them as transmitted.

Exploitation requires electronic laboratory order transmission to be configured; the receiving laboratory and transport are determined by the existing procedure-provider configuration.


4) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to create unauthorized medication-dispensing records and reduce pharmacy inventory.

The vulnerability exists due to improper access control in OpenEMR's interface/drugs/dispense_drug.php endpoint when handling medication-dispensing requests without requiring write permission for admin/drugs. A remote user can submit a GET request with medication, quantity, fee, and encounter parameters using read-only drug-administration permission to create a dispensing record for the selected patient and decrement inventory.

Exploitation requires a deployment using in-house drug dispensing and an active patient encounter selected in the read-only account's session.


5) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose other patients' laboratory-order information and modify their procedure orders without authorization.

The vulnerability exists due to missing authorization checks in OpenEMR's interface/forms/procedure_order/common.php when handling procedure-order read and save requests. A remote user can supply another patient's global order ID to read its details and, after selecting the target patient and encounter in the session, submit a save request to alter clinical history, diagnoses, patient instructions, ordered tests, and other order data without the required laboratory permission.


6) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify laboratory-order transmission flags with read-only medical permission, potentially suppressing ordered procedures from transmission or printing and delaying testing.

The vulnerability exists due to improper access control in interface/orders/order_manifest.php when processing requests to save procedure omission selections. A remote user can submit a POST request containing bn_save and form_omit selections for a chosen orderid using a patients/med=view session to change procedure do_not_send flags without write permission.


7) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose patient and laboratory-order information and modify procedure omission flags across configured patient-squad access restrictions.

The vulnerability exists due to improper access control in interface/orders/order_manifest.php when resolving a supplied orderid without enforcing the target patient's configured squad restrictions. A remote user can request a restricted patient's global order ID using a patients/med=view session to read the patient's identity, clinical history, and procedure information, and submit omission selections to modify the restricted order.

The cross-squad access violation applies to deployments with sports squads configured.


8) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass registered OAuth2 grant-type restrictions and obtain access tokens without user consent or consent-based scope restrictions.

The vulnerability exists due to missing authorization checks in OpenEMR's OAuth2 client validation when processing grant requests, allowing registered clients to use enabled grant types regardless of their registration. A remote user can submit grant_type=password to /oauth2/default/token using a confidential client's credentials and a user's username and password to obtain a token with requested registered scopes without presenting the user with a consent screen.


9) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to redeem previously issued authorization codes for access tokens after an administrator disables the OAuth2 client.

The vulnerability exists due to a missing client-enabled authorization check in CustomAuthCodeGrant::validateClient() when authenticating an authorization-code exchange using private_key_jwt. A remote user can submit an authorization code issued before client deactivation to /oauth2/default/token with a valid JWT client assertion for a client with a registered JWKS to obtain an access token despite the client being disabled.


10) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive database information and modify arbitrary patients' demographics, potentially enabling patient-portal account takeover through disclosure of an active reset value.

The vulnerability exists due to SQL injection in OpenEMR's CCR/CCDA approval insertApprovedData() methods when processing request-controlled patient-data field names. A remote user can submit a crafted request to /interface/modules/zend_modules/public/ccr/revandapprove that embeds a scalar SQL expression in a field name concatenated into an UPDATE statement to read data across database tables and modify an arbitrary patient's demographics without patient-access or pending-import checks.


11) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify clinical-rule records despite having only read-only medical permission.

The vulnerability exists due to improper access control in OpenEMR's clinical-rule editor at interface/patient_file/rules/patient_data.php when processing record updates without requiring write permission. A remote user can submit a POST request containing an existing form_entryID and replacement values while holding patients/med=view permission to change the record's completion date, completion state, and free-text result.


12) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify clinical-rule records belonging to a patient outside the user's authorized sports squad.

The vulnerability exists due to improper access control in OpenEMR's clinical-rule editor at interface/patient_file/rules/patient_data.php when selecting and updating records by a supplied global row ID without verifying the associated patient's authorization. A remote user can submit another patient's clinical-rule row ID in form_entryID to overwrite its completion date, completion state, and free-text result across a configured sports-squad boundary.


13) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass patient-report authorization and disclose a selected patient's sensitive clinical information.

The vulnerability exists due to improper access control in OpenEMR's ccdaservice/ccda_gateway.php when processing C-CDA generation requests from core sessions. A remote user can directly request the report_ccd_view action with a valid session CSRF token to retrieve the session-selected patient's Summary of Care without the patients/pat_rep permission, exposing patient identifiers, diagnoses, medications, laboratory results, and other clinical information.

Exploitation requires alternate C-CDA generation to be enabled for the clinical dashboard; the validated configuration used ccda_alt_service_enable=3.


14) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass document category access controls, disclose protected patient documents, and alter their classification.

The vulnerability exists due to missing source-document authorization in OpenEMR's Care Coordination and CCR import controllers when processing a user-supplied document_id. A remote user can submit the global ID of an inaccessible document to an import action to move it into a readable destination category and retrieve its contents through the normal document retrieval endpoint, even if subsequent parsing fails.

Exploitation requires Care Coordination to be enabled and available to the user, with a destination category less restrictive than the document's original category.


15) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose other patients' prescription information across patient and squad boundaries.

The vulnerability exists due to improper access control in the OpenEMR CAMOS prescription printer when processing submitted prescription identifiers without checking patient ownership or prescription permissions. A remote user can submit a forged chrx_ checkbox name containing another patient's global prescription ID to retrieve the prescription's drug name, strength, quantity, dosage form, route, interval, directions, and refill count.


16) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to take over patient portal accounts and access sensitive patient information.

The vulnerability exists due to missing authorization checks in OpenEMR's create_portallogin.php endpoint and PatientAccessOnsiteService::saveCredentials() method when processing patient portal credential changes. A remote user can select another patient as the current session patient and submit replacement portal credentials directly to the endpoint to overwrite that patient's credentials, sign in as the patient, and access portal-visible health information without patient-demographics or portal-management permission.

Exploitation requires the patient portal to be enabled and the target patient to have an existing portal account. Deployments enforcing portal email verification also require knowledge of the target patient's email address.


17) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive patient demographic information across the practice, including names, dates of birth, addresses, contact details, and Social Security numbers.

The vulnerability exists due to missing patient-data access controls in the OpenEMR dynamic_finder_ajax.php handler when processing patient search requests. A remote user can request /interface/main/finder/dynamic_finder_ajax.php with caller-selected patient_data columns in the sColumns parameter to enumerate patient records and retrieve sensitive demographic fields without the patients/demo permission.


18) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose patient clinical and demographic information and initiate unauthorized eRx synchronization state changes.

The vulnerability exists due to missing authorization checks in OpenEMR's Ensora eRx entry point when processing requests for a selected patient. A remote user can directly request /interface/eRx.php without patients/rx permission to retrieve patient information embedded in the launch page, submit it to the configured vendor, and trigger synchronization updates.

Exploitation requires Ensora eRx to be enabled and configured.


19) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote privileged user to execute arbitrary JavaScript in a clinician's OpenEMR session, read same-origin patient information, and submit actions with the clinician's privileges.

The vulnerability exists due to improper neutralization of stored code descriptions in the Functional and Cognitive Status form and layout-based fee-sheet forms when rendering a code selected by a clinician. A remote privileged user can use admin/superbill write permission to store a SNOMED code description containing <img src=x onerror=alert(1)>, which is subsequently assigned to innerHTML, to execute JavaScript in the clinician's authenticated session.


20) Improper Authorization (CVE-ID: N/A)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify another patient's tracker status, room assignment, and linked appointment state without authorization, disrupting patient-flow and scheduling operations.

The vulnerability exists due to improper authorization in the interface/patient_tracker/patient_tracker_status.php endpoint when processing tracker status requests containing a user-supplied tracker_id. A remote user can submit a known or guessed valid tracker identifier, a valid session CSRF token, and crafted statustype and roomnum values to alter another patient's tracker and linked appointment without patient-specific authorization checks.


21) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive files from OpenEMR's shared temporary directory, including complete patient clinical documents.

The vulnerability exists due to improper access control in OpenEMR's claim downloader at /interface/billing/get_claim_file.php when handling requests for files in the shared temporary directory. A remote user can use an account with acct/eob or acct/bill write access to submit location=tmp and a predictable file basename in the key parameter to download unrelated files readable by the PHP process without verification that they are claims generated for the caller.

The external C-CDA validator leaves a predictable file in the shared temporary directory after the validation request.


22) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript in an EOB user's authenticated OpenEMR session, disclose patient and financial information, and perform billing actions available to that user.

The vulnerability exists due to improper JavaScript-string escaping in interface/billing/sl_eob_invoice.php when rendering stored billing codes inside inline onkeyup handlers in the manual EOB payment form. A remote user can save a billing code such as x',alert(1),'y on an encounter they have permission to code, causing injected JavaScript to execute when an EOB user types in the charge's Pay field. HTML attribute escaping converts quotes to ', but the browser decodes these entities before compiling the handler, allowing the quotes to terminate the intended JavaScript strings.


23) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to electronically sign another patient's clinical form without authorization and prevent ordinary editing through the chart interface.

The vulnerability exists due to missing authorization checks in OpenEMR's electronic-signature handler in library/ESign/Form/Controller.php when processing form-signing requests. A remote user can submit a request to /interface/esign/index.php with a target form ID, form directory, encounter ID, and the account's own password to persist an unauthorized signature and an arbitrary amendment on the selected form, locking it in the normal chart interface under the default settings.


24) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to create unauthorized patient charts and associated records, compromising the integrity of clinical and billing workflows.

The vulnerability exists due to improper access control in the OpenEMR FaxSMS utility when processing patient-creation form submissions. A remote user can submit a request with a valid CSRF token using read-only demographics access to create fictitious or duplicate patient charts and associated employer, history, and insurance records without the required write or add-only permission.

Exploitation requires FaxSMS to be enabled and a fax provider to be configured.


25) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service by exhausting PHP worker resources.

The vulnerability exists due to uncontrolled resource consumption in OpenEMR's lab-label PDF generation endpoint, interface/procedure_tools/libs/labs_ajax.php, when processing print_labels requests without an upper bound on the count parameter. A remote user can submit an excessive count to trigger repeated PDF page and barcode generation, consuming worker memory and CPU until resource or execution-time limits are reached; concurrent requests can exhaust the worker pool and disrupt other OpenEMR requests.


26) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to falsify the reviewed state of another patient's allergy, medication, or medical-problem list.

The vulnerability exists due to improper access control in OpenEMR's library/ajax/lists_touch.php endpoint when processing submitted patient identifiers and clinical-list types. A remote user can submit a POST request with a valid session and CSRF token, a target patient identifier, and a list type to mark an unreviewed empty list as "None" without the required issue-write permission or patient access, also affecting quality-measure and summary-of-care calculations that rely on the marker.


27) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to exhaust PHP memory and workers, causing a denial of service in OpenEMR.

The vulnerability exists due to uncontrolled resource consumption in the EDI History, ERA upload, and Carecoordination CCDA import components when extracting ZIP entries without checking their uncompressed sizes or compression ratios. A remote user can upload highly compressed ZIP files containing large entries that are read completely into PHP strings to exceed the PHP memory limit and terminate individual workers; repeated or concurrent uploads can exhaust the available worker pool.


28) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose full patient demographic records and enumerate the entire patient roster in OpenEMR.

The vulnerability exists due to missing authorization in the Patient Validation module's PatientvalidationController::indexAction() when handling patient lookup requests. A remote user can send a direct GET request to /interface/modules/zend_modules/public/patientvalidation?mf_fname=&mf_lname=%&mf_DOB=&mf_pubpid= to retrieve all patient demographic records without per-patient authorization checks.


29) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to execute unauthorized SQL expressions, disclose database information, alter History data, and consume database and web-worker capacity.

The vulnerability exists due to improper validation of SQL identifiers in OpenEMR's SocialHistoryService::insertRecord() when inserting History data using stored layout field identifiers. A remote privileged user can store a crafted identifier such as tobacco`=sleep(3),`exams in a HIS layout or a source-H field in an LBF layout and submit the corresponding History data to inject SQL expressions into an INSERT statement, enabling unauthorized database operations and delays in affected saves.

Exploitation requires a patient without an existing history_data row. Opening either History page creates that row. Field identifiers are limited to 24 characters, constraining the available SQL payloads.


30) Missing Authentication for Critical Function (CVE-ID: N/A)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to remove a target account's registered MFA factors without re-entering the account password, leaving the account protected by its password alone.

The vulnerability exists due to missing re-authentication for a critical function in OpenEMR's interface/usergroup/mfa_registrations.php when processing MFA factor deletion requests. A remote user can use a compromised authenticated session and a valid CSRF token to submit deletion requests for all of the account's TOTP and U2F registrations to disable its MFA protection.

Subsequent sign-ins still require the account password, and the changes are limited to the account associated with the compromised session.


31) Missing Authentication for Critical Function (CVE-ID: N/A)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to register a U2F security key under their control on a target account without re-entering the account password, making that key an accepted second factor for future logins.

The vulnerability exists due to missing re-authentication for a critical function in OpenEMR's interface/usergroup/mfa_u2f.php when processing U2F key registration requests. A remote user can use a compromised authenticated session and a valid CSRF token to submit a valid U2F registration response to add a key they control to the account's accepted MFA factors.

Subsequent sign-ins still require the account password, and the changes are limited to the account associated with the compromised session.


32) Insufficient Session Expiration (CVE-ID: N/A)

CWE-ID: CWE-613 - Insufficient Session Expiration

CVSSv4: 4.3 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an attacker with physical access to system to access protected health information and perform actions through an unattended user's session after the configured idle timeout should have expired.

The vulnerability exists due to insufficient session expiration in OpenEMR's session handling when the Eye Exam form is open in read-only mode. Background polling every 15 seconds omits skip_timeout_reset, causing library/auth.inc.php to reset the idle timer despite the absence of user activity. An attacker with physical access to system can use an unattended workstation left on this view to access protected health information and act through the user's still-active session.


33) Arbitrary file upload (CVE-ID: N/A)

CWE-ID: CWE-434 - Unrestricted Upload of File with Dangerous Type

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary PHP code as the OpenEMR web-server user.

The vulnerability exists due to unrestricted upload of files containing executable PHP in OpenEMR's ERA upload handler when processing malformed ERA files, which are retained despite parsing errors at the predictable path sites/default/documents/era/.edi. A remote user can upload a malicious ERA file with acct/bill or acct/eob write permission and, using a separate database-write primitive, modify the background_services registry to have BackgroundServiceRunner load the uploaded file through require_once to execute arbitrary PHP code.


34) External Control of File Name or Path (CVE-ID: N/A)

CWE-ID: CWE-73 - External Control of File Name or Path

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose local files readable by the OpenEMR PHP process, including secrets, credentials, and patient data.

The vulnerability exists due to external control of file paths and restoration of unsanitized CSS in src/Pdf/PatientPortalPDFDocumentCreator.php when rendering user-supplied HTML as a PDF. A remote user can submit crafted content to POST /portal/lib/doc_lib.php containing CSS @import rules that load local files and incorporate their contents into a request to a user-controlled callback server to disclose sensitive information.


35) External Control of File Name or Path (CVE-ID: N/A)

CWE-ID: CWE-73 - External Control of File Name or Path

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose local file contents through generated PDF documents.

The vulnerability exists due to insufficient restriction of externally controlled file paths in mPDF's nested SVG resource loading when rendering user-supplied HTML submitted to POST /portal/lib/doc_lib.php. A remote user can reference an external SVG containing a nested image path beginning with :/php://filter/ to bypass the initial stream-wrapper check and embed transformed local file bytes in the returned PDF to disclose sensitive information.


36) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service through memory exhaustion.

The vulnerability exists due to uncontrolled resource consumption in the PDF renderer's PHP stream-filter processing when resolving user-controlled resources during PDF generation. A remote user can submit document content that causes an excessive php://filter chain to be processed to exhaust memory and cause a denial of service.


Remediation

Install update from vendor's website.

References