CVE-2026-25127
OpenEMR has Broken Access Control on Care Coordination Module
Vexday Risk Score
21Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 7EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
25 Feb 2026Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the server does not properly validate user permission. Unauthorized users can view the information of authorized users. Version 8.0.0 fixes the issue.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Affected products
openemr · openemrWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →