Improper access control in OpenEMR - #VU158862
Published: November 3, 2026
Vulnerability details
The vulnerability allows a remote user to bypass patient-report authorization and disclose a selected patient's sensitive clinical information.
The vulnerability exists due to improper access control in OpenEMR's ccdaservice/ccda_gateway.php when processing C-CDA generation requests from core sessions. A remote user can directly request the report_ccd_view action with a valid session CSRF token to retrieve the session-selected patient's Summary of Care without the patients/pat_rep permission, exposing patient identifiers, diagnoses, medications, laboratory results, and other clinical information.
Exploitation requires alternate C-CDA generation to be enabled for the clinical dashboard; the validated configuration used ccda_alt_service_enable=3.