FKIE_CVE-2026-25135

Vulnerability from fkie_nvd - Published: 2026-02-25 03:16 - Updated: 2026-02-25 16:56
Severity
4.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
Summary
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0 have an information disclosure vulnerability that leaks the entire contact information for all users, organizations, and patients in the system to anyone who has the system/(Group,Patient,*).$export operation and system/Location.read capabilities. This vulnerability will impact OpenEMR versions since 2023. This disclosure will only occur in extremely high trust environments as it requires using a confidential client with secure key exchange that requires an administrator to enable and grant permission before the app can even be used. This will typically only occur in server-server communication across trusted clients that already have established legal agreements. Version 8.0.0 contains a patch. As a workaround, disable clients that have the vulnerable scopes and only allow clients that do not have the system/Location.read scope until a fix has been deployed.
References
security-advisories@github.comhttps://github.com/openemr/openemr/commit/7ab23dfe73ebd16dd66a526272f3761f1bd5be7dPatch
security-advisories@github.comhttps://github.com/openemr/openemr/security/advisories/GHSA-fgxg-wg4w-rj23Vendor Advisory
Impacted products
Vendor Product Version
open-emr openemr *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FEAA9896-A42E-437C-BEE8-8DA955E34385",
              "versionEndExcluding": "8.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0 have an information disclosure vulnerability that leaks the entire contact information for all users, organizations, and patients in the system to anyone who has the system/(Group,Patient,*).$export operation and system/Location.read capabilities.  This vulnerability will impact OpenEMR versions since 2023. This disclosure will only occur in extremely high trust environments as it requires using a confidential client with secure key exchange that requires an administrator to enable and grant permission before the app can even be used. This will typically only occur in server-server communication across trusted clients that already have established legal agreements. Version 8.0.0 contains a patch. As a workaround, disable clients that have the vulnerable scopes and only allow clients that do not have the system/Location.read scope until a fix has been deployed."
    },
    {
      "lang": "es",
      "value": "OpenEMR es una aplicaci\u00f3n de gesti\u00f3n de registros de salud electr\u00f3nicos y pr\u00e1ctica m\u00e9dica de c\u00f3digo abierto y gratuita. Las versiones anteriores a la 8.0.0 tienen una vulnerabilidad de revelaci\u00f3n de informaci\u00f3n que filtra toda la informaci\u00f3n de contacto de todos los usuarios, organizaciones y pacientes en el sistema a cualquiera que tenga las capacidades de operaci\u00f3n system/(Group,Patient,*).$export y system/Location.read. Esta vulnerabilidad tendr\u00e1 impacto en las versiones de OpenEMR desde 2023. Esta revelaci\u00f3n solo ocurrir\u00e1 en entornos de muy alta confianza, ya que requiere el uso de un cliente confidencial con intercambio seguro de claves que requiere que un administrador habilite y otorgue permiso antes de que la aplicaci\u00f3n pueda siquiera ser utilizada. Esto t\u00edpicamente solo ocurrir\u00e1 en comunicaci\u00f3n de servidor a servidor entre clientes de confianza que ya tienen acuerdos legales establecidos. La versi\u00f3n 8.0.0 contiene un parche. Como soluci\u00f3n alternativa, deshabilite los clientes que tienen los \u00e1mbitos vulnerables y solo permita los clientes que no tienen el \u00e1mbito system/Location.read hasta que se haya implementado una correcci\u00f3n."
    }
  ],
  "id": "CVE-2026-25135",
  "lastModified": "2026-02-25T16:56:15.110",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-02-25T03:16:04.263",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/openemr/openemr/commit/7ab23dfe73ebd16dd66a526272f3761f1bd5be7d"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/openemr/openemr/security/advisories/GHSA-fgxg-wg4w-rj23"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.