Improper Authorization in OpenEMR - CVE-2026-24890
Published: April 23, 2026
Vulnerability identifier: #VU127287
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-24890
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to overwrite provider signatures and forge signatures on medical documents.
The vulnerability exists due to improper authorization in portal/sign/lib/save-signature.php when handling patient portal signature requests with type=admin-signature and a user-supplied provider user ID. A remote user can send a specially crafted POST request to overwrite provider signatures and forge signatures on medical documents.
The issue affects the backend endpoint even if the user interface restricts access to the admin signature functionality.
Affected software
OpenEMR
How to mitigate CVE-2026-24890
Install security update from vendor's website.
OpenEMR - update to 8.0.0