Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an authorization bypass vulnerability in the patient portal signature endpoint allows authenticated portal users to upload and overwrite provider signatures by setting `type=admin-signature` and specifying any provider user ID. This could potentially lead to signature forgery on medical documents, legal compliance violations, and fraud. The issue occurs when portal users are allowed to modify provider signatures without proper authorization checks. Version 8.0.0 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-24890 OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an authorization bypass vulnerability… https://www.cve.org/CVERecord?id=CVE-2026-24890
Post summary
The text announces an authorization bypass vulnerability in OpenEMR versions before 8.0.0, referencing the CVE record for further details.
**CVE-2026-24890** pertains to an authorization bypass in the OpenEMR patient portal, specifically within the signature management endpoint. Prior to version 8.0.0, authenticated users with access to the patient portal could exploit a flaw by setting the `type=admin-signature` parameter and specifying any provider user ID, thereby overwriting provider signatures without proper authorization checks. This flaw allows users to forge provider signatures on medical documents, potentially leading to legal and compliance issues. #Cybersecurity #CVE #HighSeverity #SecurityAlert #AuthBypass https://cvetodo.com/cve/CVE-2026-24890
Post summary
The post discloses an authorization bypass in OpenEMR that permits forging provider signatures, providing technical details but no PoC, exploit, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | open-emr | openemr | - | - | - |