CVE-2026-24896

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24896", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-27T19:35:20.529Z", "datePublished": "2026-02-25T01:47:59.765Z", "dateUpdated": "2026-02-25T20:58:20.711Z"}, "containers": {"cna": {"title": "OpenEMR has Broken Access Control that allows unauthorized access to EDI Logs", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/openemr/openemr/security/advisories/GHSA-rccq-vjfg-ggjh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/openemr/openemr/security/advisories/GHSA-rccq-vjfg-ggjh"}, {"name": "https://github.com/openemr/openemr/commit/1a57dfc244b30e96e7ebdb5ba6f331a6eb868df1", "tags": ["x_refsource_MISC"], "url": "https://github.com/openemr/openemr/commit/1a57dfc244b30e96e7ebdb5ba6f331a6eb868df1"}], "affected": [{"vendor": "openemr", "product": "openemr", "versions": [{"version": "< 8.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T01:47:59.765Z"}, "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a Broken Access Control vulnerability exists in OpenEMR\u2019s edih_main.php endpoint, which allows any authenticated user\u2014including low-privilege roles like Receptionist\u2014to access EDI log files by manipulating the log_select parameter in a GET request. The back-end fails to enforce role-based access control (RBAC), allowing sensitive system logs to be accessed outside the GUI-enforced permission boundaries. Version 8.0.0 fixes the issue."}], "source": {"advisory": "GHSA-rccq-vjfg-ggjh", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T20:54:32.821863Z", "id": "CVE-2026-24896", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T20:58:20.711Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24896", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-25T20:54:32.821863Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T20:58:13.049Z"}}], "cna": {"title": "OpenEMR has Broken Access Control that allows unauthorized access to EDI Logs", "source": {"advisory": "GHSA-rccq-vjfg-ggjh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "openemr", "product": "openemr", "versions": [{"status": "affected", "version": "< 8.0.0"}]}], "references": [{"url": "https://github.com/openemr/openemr/security/advisories/GHSA-rccq-vjfg-ggjh", "name": "https://github.com/openemr/openemr/security/advisories/GHSA-rccq-vjfg-ggjh", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/openemr/openemr/commit/1a57dfc244b30e96e7ebdb5ba6f331a6eb868df1", "name": "https://github.com/openemr/openemr/commit/1a57dfc244b30e96e7ebdb5ba6f331a6eb868df1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a Broken Access Control vulnerability exists in OpenEMR\u2019s edih_main.php endpoint, which allows any authenticated user\u2014including low-privilege roles like Receptionist\u2014to access EDI log files by manipulating the log_select parameter in a GET request. The back-end fails to enforce role-based access control (RBAC), allowing sensitive system logs to be accessed outside the GUI-enforced permission boundaries. Version 8.0.0 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T01:47:59.765Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24896", "state": "PUBLISHED", "dateUpdated": "2026-02-25T20:58:20.711Z", "dateReserved": "2026-01-27T19:35:20.529Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-25T01:47:59.765Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openemr", "vendor": "openemr", "versions": [{"status": "affected", "version": "< 8.0.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*", "matchCriteriaId": "FEAA9896-A42E-437C-BEE8-8DA955E34385", "versionEndExcluding": "8.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a Broken Access Control vulnerability exists in OpenEMR\u2019s edih_main.php endpoint, which allows any authenticated user\u2014including low-privilege roles like Receptionist\u2014to access EDI log files by manipulating the log_select parameter in a GET request. The back-end fails to enforce role-based access control (RBAC), allowing sensitive system logs to be accessed outside the GUI-enforced permission boundaries. Version 8.0.0 fixes the issue."}, {"lang": "es", "value": "OpenEMR es una aplicaci\u00f3n gratuita y de c\u00f3digo abierto para registros de salud electr\u00f3nicos y gesti\u00f3n de consultorios m\u00e9dicos. Antes de la versi\u00f3n 8.0.0, existe una vulnerabilidad de control de acceso roto en el endpoint edih_main.php de OpenEMR, que permite a cualquier usuario autenticado \u2014incluidos roles de bajo privilegio como Recepcionista\u2014 acceder a los archivos de registro EDI manipulando el par\u00e1metro log_select en una solicitud GET. El back-end no aplica el control de acceso basado en roles (RBAC), lo que permite acceder a registros sensibles del sistema fuera de los l\u00edmites de permisos impuestos por la GUI. La versi\u00f3n 8.0.0 soluciona el problema."}], "id": "CVE-2026-24896", "lastModified": "2026-06-17T10:23:46.117", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24896", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-25T20:54:32.821863Z", "version": "2.0.3"}}]}, "published": "2026-02-25T02:16:22.353", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/openemr/openemr/commit/1a57dfc244b30e96e7ebdb5ba6f331a6eb868df1"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/openemr/openemr/security/advisories/GHSA-rccq-vjfg-ggjh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.0.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "openemr", "source": "cna", "vendor": "openemr"}, "product": "openemr", "vendor": "openemr"}], "analysis": {"en": {"generated_at": "2026-04-17T15:33:58.716157+00:00", "value": {"mitigation_remediation": ["Upgrade OpenEMR to version 8.0.0 or later to apply the vendor patch that enforces proper role\u2011based access control on the edih_main.php endpoint.", "After upgrading, validate that only users with administrative privileges can invoke the log_select functionality by performing test requests or reviewing access logs.", "If an immediate upgrade is not possible, restrict the edih_main.php endpoint to administrators only at the web\u2011server level (e.g., using .htaccess or equivalent configuration rules) to prevent unauthorized log access until the patch can be applied."], "summary": {"action": "Patch Upgrade", "impact": "Unauthorized Access to Sensitive EDI Log Files"}, "threat_synthesis": {"affected_systems": "Older OpenEMR releases prior to version 8.0.0 are susceptible. Users running the openemr:openemr product with versions earlier than 8.0.0 are at risk; the update to 8.0.0 resolves the flaw.", "description_and_impact": "A flaw in OpenEMR\u2019s edih_main.php endpoint allows any authenticated user\u2014including low\u2011privilege roles such as Receptionist\u2014to retrieve EDI log files by tampering with the log_select GET parameter. The back\u2011end neglects role\u2011based access control, permitting read access to logs that are normally protected within the GUI. The vulnerability is a classic Broken Access Control issue, identified as CWE\u2011284.", "risk_and_exploitability": "The CVSS score of 6.5 classifies this as a medium\u2011severity vulnerability, and the EPSS score of less than 1% indicates a low likelihood of exploitation at the time of analysis. The flaw does not appear in the CISA KEV list, yet it requires authentication and is therefore likely to be leveraged by internal users or an attacker who has compromised legitimate credentials. Exploitation is straightforward: an attacker logs in, performs a GET request to edih_main.php with a manipulated log_select value, and obtains the log file. No additional privileges or conditions are required beyond authenticated access."}}}}, "created": "2026-02-25T11:35:12.401506+00:00", "updated": "2026-04-17T15:45:15.889504+00:00", "vendors": ["openemr", "openemr$PRODUCT$openemr"]}