CVE-2026-25927

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25927", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-09T16:22:17.785Z", "datePublished": "2026-02-25T18:43:25.725Z", "dateUpdated": "2026-02-26T21:33:41.716Z"}, "containers": {"cna": {"title": "OpenEMR Missing Authorization Checks in DICOM Viewer State API", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/openemr/openemr/security/advisories/GHSA-qj9f-x7v2-hrr7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/openemr/openemr/security/advisories/GHSA-qj9f-x7v2-hrr7"}], "affected": [{"vendor": "openemr", "product": "openemr", "versions": [{"version": "< 8.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T18:43:25.725Z"}, "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the DICOM viewer state API (e.g. upload or state save/load) accepts a document ID (`doc_id`) without verifying that the document belongs to the current user\u2019s authorized patient or encounter. An authenticated user can read or modify DICOM viewer state (e.g. annotations, view settings) for any document by enumerating document IDs. Version 8.0.0 fixes the issue."}], "source": {"advisory": "GHSA-qj9f-x7v2-hrr7", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25927", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T21:07:17.927858Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T21:33:41.716Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "OpenEMR Missing Authorization Checks in DICOM Viewer State API", "source": {"advisory": "GHSA-qj9f-x7v2-hrr7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "openemr", "product": "openemr", "versions": [{"status": "affected", "version": "< 8.0.0"}]}], "references": [{"url": "https://github.com/openemr/openemr/security/advisories/GHSA-qj9f-x7v2-hrr7", "name": "https://github.com/openemr/openemr/security/advisories/GHSA-qj9f-x7v2-hrr7", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the DICOM viewer state API (e.g. upload or state save/load) accepts a document ID (`doc_id`) without verifying that the document belongs to the current user\u2019s authorized patient or encounter. An authenticated user can read or modify DICOM viewer state (e.g. annotations, view settings) for any document by enumerating document IDs. Version 8.0.0 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T18:43:25.725Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25927", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T20:55:38.429742Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-02-26T20:55:46.108Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-25927", "state": "PUBLISHED", "dateUpdated": "2026-02-25T18:43:25.725Z", "dateReserved": "2026-02-09T16:22:17.785Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-25T18:43:25.725Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openemr", "vendor": "openemr", "versions": [{"status": "affected", "version": "< 8.0.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*", "matchCriteriaId": "FEAA9896-A42E-437C-BEE8-8DA955E34385", "versionEndExcluding": "8.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the DICOM viewer state API (e.g. upload or state save/load) accepts a document ID (`doc_id`) without verifying that the document belongs to the current user\u2019s authorized patient or encounter. An authenticated user can read or modify DICOM viewer state (e.g. annotations, view settings) for any document by enumerating document IDs. Version 8.0.0 fixes the issue."}, {"lang": "es", "value": "OpenEMR es una aplicaci\u00f3n de c\u00f3digo abierto y gratuita para la gesti\u00f3n de registros m\u00e9dicos electr\u00f3nicos y consultorios m\u00e9dicos. Antes de la versi\u00f3n 8.0.0, la API de estado del visor DICOM (por ejemplo, carga o guardar/cargar estado) acepta un ID de documento ('doc_id') sin verificar que el documento pertenezca al paciente o encuentro autorizado del usuario actual. Un usuario autenticado puede leer o modificar el estado del visor DICOM (por ejemplo, anotaciones, configuraciones de vista) para cualquier documento al enumerar los ID de documento. La versi\u00f3n 8.0.0 corrige el problema."}], "id": "CVE-2026-25927", "lastModified": "2026-06-17T10:25:26.480", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25927", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T21:07:17.927858Z", "version": "2.0.3"}}]}, "published": "2026-02-25T19:43:22.757", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/openemr/openemr/security/advisories/GHSA-qj9f-x7v2-hrr7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.0.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "openemr", "source": "cna", "vendor": "openemr"}, "product": "openemr", "vendor": "openemr"}], "analysis": {"en": {"generated_at": "2026-04-17T15:00:35.588080+00:00", "value": {"mitigation_remediation": ["Upgrade OpenEMR to version 8.0.0 or later, which implements proper authorization checks on the DICOM viewer state API.", "If an upgrade is not immediately possible, enforce network or application layer restrictions so that only trusted network segments or authenticated users with explicit patient or encounter access can reach the DICOM viewer state endpoints.", "Monitor access logs for unusual activity involving the DICOM viewer state API and audit document identifiers accessed by authenticated users, ensuring that users are only accessing documents they are authorized to view."], "summary": {"action": "Apply Patch", "impact": "Unauthorized Access to Patient DICOM Viewer State"}, "threat_synthesis": {"affected_systems": "The flaw affects all OpenEMR installations running a version older than 8.0.0. The products listed by the CNA are OpenEMR, a free and open source electronic health records system. No specific version numbers are listed beyond the statement that 8.0.0 and later contain a fix.", "description_and_impact": "The vulnerability lies in the DICOM viewer state API, where an authenticated user can provide a document ID without the system verifying that the document belongs to that user's authorized patient or encounter. As a result, the user can view or alter the viewer state\u2014such as annotations and view settings\u2014for any DICOM document in the system. This missing authorization check enables a potential breach of patient privacy and could lead to misrepresentation of imaging data if an attacker changes annotations or viewing parameters. The weakness corresponds to CWE\u2011639. The impact is limited to data and settings associated with the viewer state, but misuse could still expose sensitive patient information or disrupt correct clinical interpretation.", "risk_and_exploitability": "The CVSS score of 7.1 indicates a medium severity vulnerability. The EPSS score of less than 1% suggests that the likelihood of exploitation is low at this time, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers must first authenticate to the system, which is typically performed remotely by gaining user credentials. From that position, enumeration of document IDs allows abuse of the vulnerable API endpoints. Because the API lacks authorization checks, any authenticated user can read or modify state for any document, making the attack path straightforward once credentials are obtained. Overall risk is moderate, driven primarily by the requirement of valid authentication and the low exploitation probability reported."}}}}, "created": "2026-02-26T13:15:04.178804+00:00", "updated": "2026-04-17T15:15:21.817199+00:00", "vendors": ["openemr", "openemr$PRODUCT$openemr"]}