CVE-2025-46823: OpenMRS FHIR2 Auth Bypass Vulnerability

CVE-2025-46823 Overview

CVE-2025-46823 affects the openmrs-module-fhir2 component, which provides the Fast Healthcare Interoperability Resources (FHIR) REST API for OpenMRS, an open source medical records system. Versions of the FHIR2 module prior to 2.5.0 do not consistently check user privileges before processing requests. Unauthorized users can add or edit data they are not permitted to modify. The flaw is tracked as a missing authorization weakness [CWE-862] and is remotely exploitable without authentication or user interaction. Implementers should upgrade to FHIR2 2.5.0 or later to receive the patch.

Critical Impact
Remote unauthenticated attackers can create or modify protected medical record data through the FHIR REST API, undermining the confidentiality and integrity of patient records.

Affected Products

OpenMRS openmrs-module-fhir2 versions prior to 2.5.0
OpenMRS deployments exposing the FHIR2 REST API
Healthcare environments integrating with OpenMRS via FHIR endpoints

Discovery Timeline

2025-05-29 - CVE-2025-46823 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-46823

Vulnerability Analysis

The FHIR2 module exposes REST endpoints that map FHIR resources to underlying OpenMRS domain objects such as patients, encounters, observations, and practitioners. The module is expected to enforce OpenMRS privilege checks before performing create, read, update, or delete operations. In versions before 2.5.0, those privilege checks were not consistently applied across all resource handlers and operations.

As a result, requests to certain FHIR endpoints bypass the authorization layer that the OpenMRS core relies on. Attackers reaching the FHIR2 API can submit write operations against medical record resources without holding the privileges normally required by OpenMRS. The flaw affects the integrity of patient data and exposes confidential clinical information.

Root Cause

The vulnerability is a missing authorization issue [CWE-862]. The FHIR2 resource providers do not uniformly invoke OpenMRS privilege validation before delegating to service-layer operations. The privilege model in OpenMRS depends on the calling layer to assert required privileges, and gaps in the FHIR2 module leave certain code paths unprotected.

Attack Vector

Exploitation requires network access to the FHIR2 REST API. No authentication or user interaction is required for the affected code paths. An attacker issues crafted HTTP requests against FHIR endpoints to add or modify resources such as patients, observations, or encounters. Internet-exposed OpenMRS instances are at the highest risk because the FHIR API is reachable directly over the network.

No verified proof-of-concept code is published. See the GitHub Security Advisory GHSA-g5vq-w8v2-4x9j for technical specifics.

Detection Methods for CVE-2025-46823

Indicators of Compromise

Unexpected POST, PUT, or PATCH requests to /ws/fhir2/ endpoints from unauthenticated sessions or anonymous IP addresses.
New or modified FHIR resources (Patient, Encounter, Observation) without corresponding entries in OpenMRS audit logs for an authenticated provider.
HTTP 200 or 201 responses from FHIR2 endpoints in cases where the requesting principal lacks the expected OpenMRS privileges.

Detection Strategies

Review web server and application logs for FHIR2 write operations and correlate them against the authenticated OpenMRS user and assigned privileges.
Enable verbose OpenMRS auditing and compare FHIR-originated changes to changes made through the standard OpenMRS web interface.
Run integrity checks on recent patient record modifications to identify entries created or altered without an associated authorized user.

Monitoring Recommendations

Alert on FHIR2 API traffic originating from outside expected integration partners or clinical IP ranges.
Track the volume of write operations per endpoint and flag deviations from baseline integration traffic.
Forward OpenMRS and reverse proxy logs to a centralized analytics platform for retention and correlation across the FHIR2 module version history.

How to Mitigate CVE-2025-46823

Immediate Actions Required

Upgrade the FHIR2 module to version 2.5.0 or later on all OpenMRS instances.
Restrict network access to FHIR2 endpoints to authorized integration partners until the patch is applied.
Audit FHIR2 write activity since the module was first deployed to identify unauthorized changes to patient data.

Patch Information

The OpenMRS project released the fix in GitHub Release 2.5.0. The release adds the missing privilege checks across FHIR2 resource handlers. Coordinated disclosure details are documented in GitHub Security Advisory GHSA-g5vq-w8v2-4x9j.

Workarounds

Place the FHIR2 API behind an authenticating reverse proxy that enforces client certificate or token-based access for all requests.
Disable the FHIR2 module on instances that do not require FHIR interoperability until the upgrade can be scheduled.
Apply network-level access control lists to limit FHIR2 endpoints to specific integration source addresses.

bash

# Configuration example: restrict FHIR2 endpoints at the reverse proxy (nginx)
location /openmrs/ws/fhir2/ {
    allow 10.10.20.0/24;   # trusted integration subnet
    deny  all;
    auth_request /auth;    # require upstream authentication
    proxy_pass http://openmrs_backend;
}