CVE-2026-33918

Katalog CVE

CVSS 8.8 · High EPSS 0,45%

Kerentanan Missing Authorization pada open-emr openemr. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the billing file-download endpoint `interface/billing/get_claim_file.php` only verifies that the caller has a valid session and CSRF token, but does not check any ACL permissions. This allows any authenticated OpenEMR user — regardless of whether they have billing privileges — to download and permanently delete electronic claim batch files containing protected health information (PHI). Version 8.0.0.3 patches the issue.

Rincian

Terbit di NVD

26 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openemr/openemr/security/advisories/GHSA-g3p5-5grq-m65m advisory vendor
• https://github.com/openemr/openemr/commit/f6d98d0102df0a8f131be560d9208fb65fba6188 patch
• https://github.com/openemr/openemr/releases/tag/v8_0_0_3 product