CVE-2026-25744Disclosure(open-emr / openemr)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the encounter vitals API accepts an `id` in the request body and treats it as an UPDATE. There is no verification that the vital belongs to the current patient or encounter. An authenticated user with encounters/notes permission can overwrite any patient's vitals by supplying another patient's vital `id`, leading to medical record tampering. Version 8.0.0.2 fixes the issue.

open-emr CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/openemr/openemr/commit/c3a47c37619cdb4f0aaa168e39a93ab1d106429c

Exploit / PoC references

https://github.com/openemr/openemr/security/advisories/GHSA-mv9m-j65p-g55f

Weakness type (CWE)

CWE-639

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

openemr

Threat summary

1 mentions across 1 observed day

What's happening

Disclosure: 1 classified signal
1 total mentions across 1 day

Affected systems

Vendors

open-emr

Products

openemr

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://www.cve.org/CVERecord?id=CVE-2026-25744

Full discourse1 post

CVE@CVEnew200d
Disclosure
CVE-2026-25744 OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the encounter vitals API accepts an `id` in… https://www.cve.org/CVERecord?id=CVE-2026-25744
Post summary
The text provides a brief announcement of CVE-2026-25744, stating that the encounter vitals API accepts an `id` parameter prior to OpenEMR 8.0.0.2, but it does not include any exploit code, patch information, or detailed technical data.
0000065
56.8K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	open-emr	openemr	-	-	-

Explore more

Back to dashboard open-emr CVEs openemr vulnerabilities