CVE-2026-25929

Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the document controller’s `patient_picture` context serves the patient’s photo by document ID or patient ID without verifying that the current user is authorized to access that patient. An authenticated user with document ACL can supply another patient’s ID and retrieve their photo. Version 8.0.0 fixes the issue.

PUBLISHED Reserved 2026-02-09 | Published 2026-02-25 | Updated 2026-02-26 | Assigner GitHub_M

Problem types

CWE-639: Authorization Bypass Through User-Controlled Key

Product status

References

github.com/...penemr/security/advisories/GHSA-778w-r8rm-8qhq

github.com/...ommit/fc4d00ecb63561dacd23cb1fed49c64bd1a83258

cve.org (CVE-2026-25929)

nvd.nist.gov (CVE-2026-25929)

Download JSON