Improper Authorization in OpenEMR - CVE-2026-24890
Published: April 23, 2026
Vulnerability identifier: #VU127287
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-24890
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: OpenEMR
Affected software:
OpenEMR
OpenEMR
Detailed vulnerability description
The vulnerability allows a remote user to overwrite provider signatures and forge signatures on medical documents.
The vulnerability exists due to improper authorization in portal/sign/lib/save-signature.php when handling patient portal signature requests with type=admin-signature and a user-supplied provider user ID. A remote user can send a specially crafted POST request to overwrite provider signatures and forge signatures on medical documents.
The issue affects the backend endpoint even if the user interface restricts access to the admin signature functionality.
How to mitigate CVE-2026-24890
Install security update from vendor's website.