Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the REST API route table in `apis/routes/_rest_routes_standard.inc.php` does not call `RestConfig::request_authorization_check()` for the document and insurance routes. Other patient routes in the same file (e.g. encounters, patients/med) call it with the appropriate ACL. As a result, any valid API bearer token can access or modify every patient's documents and insurance data, regardless of the token’s OpenEMR ACLs—effectively exposing all document and insurance PHI to any authenticated API client. Version 8.0.0 patches the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-25 | 1 | Disclosure1 |
| 2026-02-26 | 1 | General1 |
CVE-2026-25164 OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the REST API route table in `apis/rou… https://www.cve.org/CVERecord?id=CVE-2026-25164
Post summary
The text briefly references CVE-2026-25164 for OpenEMR, noting a version issue but provides no further details.
CVE-2026-25164 pertains to a critical security flaw in OpenEMR, an open-source electronic health records (EHR) and practice management system. The vulnerability arises from improper authorization checks within the REST API routes, specifically in the file `apis/routes/_rest_routes_standard.inc.php`. Prior to version 8.0.0, certain API endpoints related to documents and insurance data do not invoke the necessary access control verification (`RestConfig::request_authorization_check()`). Consequently, any valid API bearer token can access or modify sensitive patient data without regard to the token's assigned permissions. #Cybersecurity #CVE #HighSeverity #SecurityAlert #RemoteCodeExecution https://cvetodo.com/cve/CVE-2026-25164
Post summary
The post discloses a critical authorization bypass in OpenEMR’s REST API that lets any bearer token read or modify sensitive data, but it does not mention a PoC, exploit, or patch.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | open-emr | openemr | - | - | - |