CVE-2026-33931

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33931", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-24T19:50:52.102Z", "datePublished": "2026-03-25T23:36:48.165Z", "dateUpdated": "2026-03-26T19:52:11.647Z"}, "containers": {"cna": {"title": "OpenEMR has IDOR in Portal Payment Page that Allows Cross-Patient Record Access", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/openemr/openemr/security/advisories/GHSA-hf37-5rp9-j27j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/openemr/openemr/security/advisories/GHSA-hf37-5rp9-j27j"}, {"name": "https://github.com/openemr/openemr/commit/7bf30e0ec5587f80c19094d58df09d46ac328806", "tags": ["x_refsource_MISC"], "url": "https://github.com/openemr/openemr/commit/7bf30e0ec5587f80c19094d58df09d46ac328806"}, {"name": "https://github.com/openemr/openemr/releases/tag/v8_0_0_3", "tags": ["x_refsource_MISC"], "url": "https://github.com/openemr/openemr/releases/tag/v8_0_0_3"}], "affected": [{"vendor": "openemr", "product": "openemr", "versions": [{"version": "< 8.0.0.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-25T23:36:48.165Z"}, "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an Insecure Direct Object Reference (IDOR) vulnerability in the patient portal payment page allows any authenticated portal patient to access other patients' payment records \u2014 including invoice/billing data (PHI) and payment card metadata \u2014 by manipulating the `recid` query parameter in `portal/portal_payment.php`. Version 8.0.0.3 patches the issue."}], "source": {"advisory": "GHSA-hf37-5rp9-j27j", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33931", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-26T19:37:34.741059Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T19:52:11.647Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33931", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-26T19:37:34.741059Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T19:50:55.777Z"}}], "cna": {"title": "OpenEMR has IDOR in Portal Payment Page that Allows Cross-Patient Record Access", "source": {"advisory": "GHSA-hf37-5rp9-j27j", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "openemr", "product": "openemr", "versions": [{"status": "affected", "version": "< 8.0.0.3"}]}], "references": [{"url": "https://github.com/openemr/openemr/security/advisories/GHSA-hf37-5rp9-j27j", "name": "https://github.com/openemr/openemr/security/advisories/GHSA-hf37-5rp9-j27j", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/openemr/openemr/commit/7bf30e0ec5587f80c19094d58df09d46ac328806", "name": "https://github.com/openemr/openemr/commit/7bf30e0ec5587f80c19094d58df09d46ac328806", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/openemr/openemr/releases/tag/v8_0_0_3", "name": "https://github.com/openemr/openemr/releases/tag/v8_0_0_3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an Insecure Direct Object Reference (IDOR) vulnerability in the patient portal payment page allows any authenticated portal patient to access other patients' payment records \u2014 including invoice/billing data (PHI) and payment card metadata \u2014 by manipulating the `recid` query parameter in `portal/portal_payment.php`. Version 8.0.0.3 patches the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-25T23:36:48.165Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33931", "state": "PUBLISHED", "dateUpdated": "2026-03-26T19:52:11.647Z", "dateReserved": "2026-03-24T19:50:52.102Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-25T23:36:48.165Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openemr", "vendor": "openemr", "versions": [{"status": "affected", "version": "< 8.0.0.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*", "matchCriteriaId": "E3E098AF-42A1-4798-85A7-80052F19F809", "versionEndExcluding": "8.0.0.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an Insecure Direct Object Reference (IDOR) vulnerability in the patient portal payment page allows any authenticated portal patient to access other patients' payment records \u2014 including invoice/billing data (PHI) and payment card metadata \u2014 by manipulating the `recid` query parameter in `portal/portal_payment.php`. Version 8.0.0.3 patches the issue."}, {"lang": "es", "value": "OpenEMR es una aplicaci\u00f3n de gesti\u00f3n de registros m\u00e9dicos electr\u00f3nicos y de pr\u00e1ctica m\u00e9dica de c\u00f3digo abierto y gratuita. Antes de la versi\u00f3n 8.0.0.3, una vulnerabilidad de Referencia Directa Insegura a Objeto (IDOR) en la p\u00e1gina de pago del portal del paciente permite a cualquier paciente autenticado del portal acceder a los registros de pago de otros pacientes \u2014 incluyendo datos de facturaci\u00f3n (PHI) y metadatos de tarjetas de pago \u2014 manipulando el par\u00e1metro de consulta 'recid' en 'portal/portal_payment.PHP'. La versi\u00f3n 8.0.0.3 corrige el problema."}], "id": "CVE-2026-33931", "lastModified": "2026-06-17T10:38:19.340", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33931", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-26T19:37:34.741059Z", "version": "2.0.3"}}]}, "published": "2026-03-26T00:16:39.787", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/openemr/openemr/commit/7bf30e0ec5587f80c19094d58df09d46ac328806"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/openemr/openemr/releases/tag/v8_0_0_3"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/openemr/openemr/security/advisories/GHSA-hf37-5rp9-j27j"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,8.0.0.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "openemr", "source": "cna", "vendor": "openemr"}, "product": "openemr", "vendor": "openemr"}], "analysis": {"en": {"generated_at": "2026-03-26T17:53:13.882508+00:00", "value": {"mitigation_remediation": ["Apply the OpenEMR patch to version 8.0.0.3 or later to eliminate the IDOR behavior."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized access to patient payment and PHI data via IDOR"}, "threat_synthesis": {"affected_systems": "OpenEMR, version 8.0.0.2 and earlier, is affected. The vulnerability is in the patient portal payment page of the OpenEMR application.", "description_and_impact": "An insecure direct object reference in the patient portal payment page allows authenticated patients to view payment records that belong to other patients by manipulating the recid query parameter. This enables exposure of billing information and payment card metadata, compromising confidentiality of protected health information and potentially enabling financial fraud.", "risk_and_exploitability": "The CVSS score of 6.5 indicates medium severity while an EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attack requires only that an attacker has an authenticated patient account; no additional credentials or administrative access are necessary, making the attack surface broad for all users of the affected versions."}}}}, "created": "2026-03-26T11:31:08.503953+00:00", "updated": "2026-03-27T09:29:20.749055+00:00", "vendors": ["openemr", "openemr$PRODUCT$openemr"]}