Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenEMR is a free and open source electronic health records and medical practice management application. In versions up to and including 8.0.0, the eye exam (eye_mag) view loads data by `form_id` (or equivalent) without verifying that the form belongs to the current user’s patient/encounter context. An authenticated user can access or edit any patient’s eye exam by supplying another form ID; in some flows the session’s active patient may also be switched. A fix is available on the `main` branch of the OpenEMR GitHub repository.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-27943 OpenEMR is a free and open source electronic health records and medical practice management application. In versions up to and including 8.0.0, the eye exam (eye_mag)… https://www.cve.org/CVERecord?id=CVE-2026-27943
Post summary
The text briefly references CVE-2026-27943 affecting OpenEMR up to version 8.0.0 but provides no further details.
CVE-2026-27943 OpenEMR Authenticated Privilege Escalation via Unvalidated Form Access https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27943
Post summary
The text announces CVE-2026-27943, an authenticated privilege escalation vulnerability in OpenEMR caused by unvalidated form access, but offers no PoC, exploit code, active exploitation evidence, or mitigation details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | open-emr | openemr | - | - | - |