CVE-2026-25124

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25124", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-29T14:03:42.539Z", "datePublished": "2026-02-25T01:50:22.146Z", "dateUpdated": "2026-02-25T20:50:25.100Z"}, "containers": {"cna": {"title": "OpenEMR has Broken Access Control in Report/Clients/Message List CSV Export", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/openemr/openemr/security/advisories/GHSA-q7p5-rrwj-qmp2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/openemr/openemr/security/advisories/GHSA-q7p5-rrwj-qmp2"}, {"name": "https://github.com/openemr/openemr/commit/ad902d6892482fff2e3c56bfb15597df8b6c3beb", "tags": ["x_refsource_MISC"], "url": "https://github.com/openemr/openemr/commit/ad902d6892482fff2e3c56bfb15597df8b6c3beb"}], "affected": [{"vendor": "openemr", "product": "openemr", "versions": [{"version": "< 8.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T01:50:22.146Z"}, "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the OpenEMR application is vulnerable to an access control flaw that allows low-privileged users, such as receptionists, to export the entire message list containing sensitive patient and user data. The vulnerability lies in the message_list.php report export functionality, where there is no permission check before executing sensitive database queries. The only control in place is CSRF token verification, which does not prevent unauthorized data access if the token is acquired through other means. Version 8.0.0 fixes the vulnerability."}], "source": {"advisory": "GHSA-q7p5-rrwj-qmp2", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T20:47:37.468118Z", "id": "CVE-2026-25124", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T20:50:25.100Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25124", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-25T20:47:37.468118Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T20:49:53.008Z"}}], "cna": {"title": "OpenEMR has Broken Access Control in Report/Clients/Message List CSV Export", "source": {"advisory": "GHSA-q7p5-rrwj-qmp2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "openemr", "product": "openemr", "versions": [{"status": "affected", "version": "< 8.0.0"}]}], "references": [{"url": "https://github.com/openemr/openemr/security/advisories/GHSA-q7p5-rrwj-qmp2", "name": "https://github.com/openemr/openemr/security/advisories/GHSA-q7p5-rrwj-qmp2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/openemr/openemr/commit/ad902d6892482fff2e3c56bfb15597df8b6c3beb", "name": "https://github.com/openemr/openemr/commit/ad902d6892482fff2e3c56bfb15597df8b6c3beb", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the OpenEMR application is vulnerable to an access control flaw that allows low-privileged users, such as receptionists, to export the entire message list containing sensitive patient and user data. The vulnerability lies in the message_list.php report export functionality, where there is no permission check before executing sensitive database queries. The only control in place is CSRF token verification, which does not prevent unauthorized data access if the token is acquired through other means. Version 8.0.0 fixes the vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T01:50:22.146Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25124", "state": "PUBLISHED", "dateUpdated": "2026-02-25T20:50:25.100Z", "dateReserved": "2026-01-29T14:03:42.539Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-25T01:50:22.146Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openemr", "vendor": "openemr", "versions": [{"status": "affected", "version": "< 8.0.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*", "matchCriteriaId": "FEAA9896-A42E-437C-BEE8-8DA955E34385", "versionEndExcluding": "8.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the OpenEMR application is vulnerable to an access control flaw that allows low-privileged users, such as receptionists, to export the entire message list containing sensitive patient and user data. The vulnerability lies in the message_list.php report export functionality, where there is no permission check before executing sensitive database queries. The only control in place is CSRF token verification, which does not prevent unauthorized data access if the token is acquired through other means. Version 8.0.0 fixes the vulnerability."}, {"lang": "es", "value": "OpenEMR es una aplicaci\u00f3n de c\u00f3digo abierto y gratuita para registros de salud electr\u00f3nicos y gesti\u00f3n de consultorios m\u00e9dicos. Antes de la versi\u00f3n 8.0.0, la aplicaci\u00f3n OpenEMR es vulnerable a un fallo de control de acceso que permite a usuarios con pocos privilegios, como recepcionistas, exportar la lista completa de mensajes que contiene datos sensibles de pacientes y usuarios. La vulnerabilidad reside en la funcionalidad de exportaci\u00f3n de informes de message_list.php, donde no hay una verificaci\u00f3n de permisos antes de ejecutar consultas sensibles a la base de datos. El \u00fanico control implementado es la verificaci\u00f3n del token CSRF, lo que no impide el acceso no autorizado a los datos si el token se adquiere por otros medios. La versi\u00f3n 8.0.0 corrige la vulnerabilidad."}], "id": "CVE-2026-25124", "lastModified": "2026-06-17T10:24:08.983", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25124", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-25T20:47:37.468118Z", "version": "2.0.3"}}]}, "published": "2026-02-25T02:16:22.550", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/openemr/openemr/commit/ad902d6892482fff2e3c56bfb15597df8b6c3beb"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/openemr/openemr/security/advisories/GHSA-q7p5-rrwj-qmp2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.0.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "openemr", "source": "cna", "vendor": "openemr"}, "product": "openemr", "vendor": "openemr"}], "analysis": {"en": {"generated_at": "2026-04-18T10:50:59.515535+00:00", "value": {"mitigation_remediation": ["Upgrade OpenEMR to version 8.0.0 or later to apply the official fix that adds proper permission checks.", "After upgrading, audit and adjust role permissions so that only authorized users can access export reports; remove the export capability from low\u2011privileged roles.", "If an upgrade cannot be performed immediately, disable the message list export functionality for low\u2011privilege accounts or implement an application\u2011level firewall rule to block message_list.php requests from those users."], "summary": {"action": "Apply patch", "impact": "Unauthorized data disclosure"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all OpenEMR releases prior to version 8.0.0 across all operating systems. Organizations running these older builds are at risk, irrespective of the underlying platform.", "description_and_impact": "A broken access control flaw in OpenEMR's message_list.php report export allows users with low privileges, such as receptionists, to request a CSV download that retrieves the entire internal message list containing sensitive patient and user data. The flaw stems from the absence of a permission check before executing the database query; the only safeguard is CSRF token verification, which does not prevent unauthorized data gathering if a token can be obtained or forged.", "risk_and_exploitability": "The assigned CVSS score of 6.5 places the issue in the medium severity category. EPSS indicates an exploitation probability below 1%, and the vulnerability is not listed in the CISA KEV catalog. An attacker would typically send a crafted request to message_list.php carrying a valid CSRF token and the low\u2011privilege user's permissions, triggering the export and leaking confidential data."}}}}, "created": "2026-02-25T11:35:11.509488+00:00", "updated": "2026-04-18T11:00:05.736960+00:00", "vendors": ["openemr", "openemr$PRODUCT$openemr"]}