CVE-2026-25929Medium· 6.5▾ TwilightPoC availableOpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the document controller’s `patient_picture` context serves the patient’s photo by document ID or patient ID …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 35.8 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the document controller’s patient_picture context serves the patient’s photo by document ID or patient ID without verifying that the current user is authorized to access that patient. An authenticated user with document ACL can supply another patient’s ID and retrieve their photo. Version 8.0.0 fixes the issue.
openemr < 8.0.0Upgrade past the affected range:
openemr 8.0.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-102940Critical· 9.6OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment
CVE-2026-104135Medium· 6.5OpenEMR: Missing authorization in payment patient-search AJAX leaks patient directory and dates of birth
CVE-2026-115573High· 8.1OpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumeration
CVE-2026-103939Medium· 5.4OpenEMR: Weno `file_download.php`: missing ACL/CSRF truncates the e-prescribing pharmacy directory
CVE-2026-49142High· 8.8OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[]
CVE-2026-40507Medium· 6.1OpenEMR before 8.3.0 contains a reflected cross-site scripting vulnerability in the patient portal template import handler