---
id: CVE-2026-25929
title: >-
  OpenEMR is a free and open source electronic health records and medical
  practice management application
summary: >-
  OpenEMR is a free and open source electronic health records and medical
  practice management application. Prior to version 8.0.0, the document
  controller’s `patient_picture` context serves the patient’s photo by document
  ID or patient ID …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-639
vendor: open-emr
product: openemr
affected:
  - openemr < 8.0.0
patched:
  - openemr 8.0.0
published: '2026-02-25'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T23:17:40.703'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-25929'
references:
  - url: >-
      https://github.com/openemr/openemr/commit/fc4d00ecb63561dacd23cb1fed49c64bd1a83258
    label: security-advisories@github.com
  - url: 'https://github.com/openemr/openemr/security/advisories/GHSA-778w-r8rm-8qhq'
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-02-26T21:24:26.005961Z'
epss: 0.00301
epssPercentile: 0.23018
ingestedAt: '2026-11-05T06:38:03.603Z'
---

## Overview

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the document controller’s `patient_picture` context serves the patient’s photo by document ID or patient ID without verifying that the current user is authorized to access that patient. An authenticated user with document ACL can supply another patient’s ID and retrieve their photo. Version 8.0.0 fixes the issue.

## Affected

- `openemr < 8.0.0`

## Remediation

Upgrade past the affected range:

- `openemr 8.0.0`