CVE-2026-33918

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33918", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-24T15:41:47.492Z", "datePublished": "2026-03-25T23:35:06.883Z", "dateUpdated": "2026-03-26T18:09:09.836Z"}, "containers": {"cna": {"title": "OpenEMR Missing Authorization on Claim File Download Endpoint", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/openemr/openemr/security/advisories/GHSA-g3p5-5grq-m65m", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/openemr/openemr/security/advisories/GHSA-g3p5-5grq-m65m"}, {"name": "https://github.com/openemr/openemr/commit/f6d98d0102df0a8f131be560d9208fb65fba6188", "tags": ["x_refsource_MISC"], "url": "https://github.com/openemr/openemr/commit/f6d98d0102df0a8f131be560d9208fb65fba6188"}, {"name": "https://github.com/openemr/openemr/releases/tag/v8_0_0_3", "tags": ["x_refsource_MISC"], "url": "https://github.com/openemr/openemr/releases/tag/v8_0_0_3"}], "affected": [{"vendor": "openemr", "product": "openemr", "versions": [{"version": "< 8.0.0.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-25T23:35:06.883Z"}, "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the billing file-download endpoint `interface/billing/get_claim_file.php` only verifies that the caller has a valid session and CSRF token, but does not check any ACL permissions. This allows any authenticated OpenEMR user \u2014 regardless of whether they have billing privileges \u2014 to download and permanently delete electronic claim batch files containing protected health information (PHI). Version 8.0.0.3 patches the issue."}], "source": {"advisory": "GHSA-g3p5-5grq-m65m", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-26T18:09:02.801572Z", "id": "CVE-2026-33918", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T18:09:09.836Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33918", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-26T18:09:02.801572Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T18:09:06.700Z"}}], "cna": {"title": "OpenEMR Missing Authorization on Claim File Download Endpoint", "source": {"advisory": "GHSA-g3p5-5grq-m65m", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "openemr", "product": "openemr", "versions": [{"status": "affected", "version": "< 8.0.0.3"}]}], "references": [{"url": "https://github.com/openemr/openemr/security/advisories/GHSA-g3p5-5grq-m65m", "name": "https://github.com/openemr/openemr/security/advisories/GHSA-g3p5-5grq-m65m", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/openemr/openemr/commit/f6d98d0102df0a8f131be560d9208fb65fba6188", "name": "https://github.com/openemr/openemr/commit/f6d98d0102df0a8f131be560d9208fb65fba6188", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/openemr/openemr/releases/tag/v8_0_0_3", "name": "https://github.com/openemr/openemr/releases/tag/v8_0_0_3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the billing file-download endpoint `interface/billing/get_claim_file.php` only verifies that the caller has a valid session and CSRF token, but does not check any ACL permissions. This allows any authenticated OpenEMR user \u2014 regardless of whether they have billing privileges \u2014 to download and permanently delete electronic claim batch files containing protected health information (PHI). Version 8.0.0.3 patches the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-25T23:35:06.883Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33918", "state": "PUBLISHED", "dateUpdated": "2026-03-26T18:09:09.836Z", "dateReserved": "2026-03-24T15:41:47.492Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-25T23:35:06.883Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openemr", "vendor": "openemr", "versions": [{"status": "affected", "version": "< 8.0.0.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*", "matchCriteriaId": "E3E098AF-42A1-4798-85A7-80052F19F809", "versionEndExcluding": "8.0.0.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the billing file-download endpoint `interface/billing/get_claim_file.php` only verifies that the caller has a valid session and CSRF token, but does not check any ACL permissions. This allows any authenticated OpenEMR user \u2014 regardless of whether they have billing privileges \u2014 to download and permanently delete electronic claim batch files containing protected health information (PHI). Version 8.0.0.3 patches the issue."}, {"lang": "es", "value": "OpenEMR es una aplicaci\u00f3n gratuita y de c\u00f3digo abierto para registros de salud electr\u00f3nicos y gesti\u00f3n de consultorios m\u00e9dicos. Antes de la versi\u00f3n 8.0.0.3, el endpoint de descarga de archivos de facturaci\u00f3n 'interface/billing/get_claim_file.php' solo verifica que el solicitante tenga una sesi\u00f3n v\u00e1lida y un token CSRF, pero no comprueba ning\u00fan permiso ACL. Esto permite a cualquier usuario autenticado de OpenEMR \u2014 independientemente de si tienen privilegios de facturaci\u00f3n \u2014 descargar y eliminar permanentemente archivos de lotes de reclamaciones electr\u00f3nicas que contienen informaci\u00f3n de salud protegida (PHI). La versi\u00f3n 8.0.0.3 corrige el problema."}], "id": "CVE-2026-33918", "lastModified": "2026-06-17T10:38:19.080", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33918", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-26T18:09:02.801572Z", "version": "2.0.3"}}]}, "published": "2026-03-26T00:16:39.627", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/openemr/openemr/commit/f6d98d0102df0a8f131be560d9208fb65fba6188"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/openemr/openemr/releases/tag/v8_0_0_3"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/openemr/openemr/security/advisories/GHSA-g3p5-5grq-m65m"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,8.0.0.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "openemr", "source": "cna", "vendor": "openemr"}, "product": "openemr", "vendor": "openemr"}], "analysis": {"en": {"generated_at": "2026-03-26T17:27:10.745665+00:00", "value": {"mitigation_remediation": ["Apply the OpenEMR update to version 8.0.0.3 or later to resolve the missing ACL check.", "Ensure that the claim file download endpoint is protected by policy and is only reachable by users with billing privileges.", "Verify that session and CSRF token verification remain intact while adding the necessary ACL validation."], "summary": {"action": "Patch immediately", "impact": "Unauthorized download and deletion of PHI claim batch files by any authenticated user even without billing rights."}, "threat_synthesis": {"affected_systems": "OpenEMR installations running any version prior to 8.0.0.3 are affected. The flaw applies to all affected deployments regardless of user role, as the endpoint accepts authenticated sessions without validating billing privileges.", "description_and_impact": "A missing ACL check on the billing file\u2011download endpoint allows any authenticated OpenEMR user to download and permanently delete claim batch files that contain protected health information. This results in unauthorized disclosure of PHI and potential loss of critical data.", "risk_and_exploitability": "The CVSS score of 7.6 denotes a high severity, and the EPSS score of less than 1% suggests a low probability of observed exploitation. Nonetheless, because the vulnerability can be triggered by any logged\u2011in user, the risk to organizations handling PHI is significant. The fix is to apply the vendor patch; in the absence of a patch, accessing the endpoint without proper ACL checks is a serious security concern."}}}}, "created": "2026-03-26T11:31:10.334295+00:00", "updated": "2026-03-27T09:29:21.672466+00:00", "vendors": ["openemr", "openemr$PRODUCT$openemr"]}