Improper access control in OpenEMR - CVE-2026-25124
Published: April 23, 2026
Vulnerability identifier: #VU127263
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-25124
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in interface/reports/message_list.php when handling CSV export requests. A remote user can send a crafted POST request with form_csvexport=true to disclose sensitive information.
The issue affects the report export functionality for the message list and can expose patient and user message data.
Affected software
OpenEMR
How to mitigate CVE-2026-25124
Install security update from vendor's website.
OpenEMR - update to 8.0.0