CVE-2026-24896: OpenEMR Auth Bypass Vulnerability

CVE-2026-24896 Overview

CVE-2026-24896 is a Broken Access Control vulnerability affecting OpenEMR, a widely-used free and open source electronic health records (EHR) and medical practice management application. The vulnerability exists in OpenEMR's edih_main.php endpoint, which allows any authenticated user—including low-privilege roles like Receptionist—to access EDI (Electronic Data Interchange) log files by manipulating the log_select parameter in a GET request.

The back-end implementation fails to enforce role-based access control (RBAC), allowing sensitive system logs to be accessed outside the GUI-enforced permission boundaries. This represents a significant information disclosure risk in healthcare environments where log files may contain protected health information (PHI) or sensitive billing data.

Critical Impact

Low-privilege authenticated users can access sensitive EDI log files containing potentially protected health information, bypassing intended access controls in healthcare management systems.

Affected Products

• OpenEMR versions prior to 8.0.0
• open-emr openemr (all versions before the security patch)

Discovery Timeline

• 2026-02-25 - CVE-2026-24896 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-24896

Vulnerability Analysis

This vulnerability stems from a failure to implement proper authorization checks in the edih_main.php endpoint. While the OpenEMR GUI enforces permission boundaries preventing low-privilege users from accessing EDI log functionality, the underlying PHP endpoint lacks corresponding server-side RBAC validation.

When an authenticated user sends a crafted GET request with a manipulated log_select parameter to interface/billing/edih_main.php, the server processes the request and returns EDI log file contents without verifying whether the requesting user has the necessary acct and eob (Explanation of Benefits) permissions. This represents a classic example of client-side enforcement without corresponding server-side validation.

The vulnerability is accessible over the network and requires low privileges (any authenticated user), making it exploitable by insider threats or compromised low-privilege accounts.

Root Cause

The root cause is the absence of ACL (Access Control List) checks in the edih_main.php file. The endpoint processed requests from any authenticated session without validating whether the user's role had the required permissions to access billing and EOB information. The fix introduces the AclMain::aclCheckCore('acct', 'eob') check to enforce proper RBAC at the server level.

Attack Vector

An attacker with any authenticated session (even a receptionist-level account) can exploit this vulnerability by directly accessing the edih_main.php endpoint and manipulating the log_select parameter. The attack can be performed through:

1. Direct URL manipulation in the browser address bar
2. Intercepting and modifying requests through a proxy
3. Automated scripts using valid session cookies

The following patch demonstrates the security fix implemented in version 8.0.0:

  * @link      http://www.open-emr.org
  * @author    Kevin McCormick Longview, Texas
  * @author    Brady Miller <brady.g.miller@gmail.com>
+ * @author    Michael A. Smith <michael@opencoreemr.com>
  * @copyright Copyright (c) 2012 Kevin McCormick Longview, Texas
  * @copyright Copyright (c) 2018 Brady Miller <brady.g.miller@gmail.com>
+ * @copyright Copyright (c) 2026 OpenCoreEMR Inc <https://opencoreemr.com/>
  * @license   https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
  */
 
 require_once(__DIR__ . "/../globals.php");
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
 
+// Access control - same permission required as edih_view.php
+if (!AclMain::aclCheckCore('acct', 'eob')) {
+    http_response_code(403);
+    die(xlt('Access denied'));
+}
+
 /**
  * this define is used to prevent direct access to the included scripts
  * which have the corresponding definition commented for now

Source: GitHub Commit 1a57dfc

Detection Methods for CVE-2026-24896

Indicators of Compromise

• Unexpected HTTP requests to /interface/billing/edih_main.php from users without billing access roles
• Access log entries showing log_select parameter manipulation from non-administrative accounts
• Audit trails showing EDI log file access by users lacking acct or eob ACL permissions
• Multiple sequential requests to the EDI endpoint from a single low-privilege session

Detection Strategies

• Implement web application firewall (WAF) rules to flag direct access attempts to edih_main.php endpoints
• Monitor HTTP access logs for requests to billing endpoints from user accounts with receptionist or other low-privilege roles
• Enable OpenEMR audit logging and correlate EDI endpoint access with user permission levels
• Deploy SIEM rules to detect anomalous access patterns to sensitive billing endpoints

Monitoring Recommendations

• Enable verbose access logging for all endpoints under /interface/billing/
• Implement user behavior analytics (UBA) to detect privilege boundary violations
• Configure alerts for HTTP 200 responses to edih_main.php from non-billing user sessions
• Review audit logs periodically for signs of reconnaissance or data exfiltration attempts

How to Mitigate CVE-2026-24896

Immediate Actions Required

• Upgrade OpenEMR to version 8.0.0 or later immediately
• Review access logs for historical exploitation attempts targeting edih_main.php
• Audit user accounts to identify any compromised or overly permissive credentials
• Conduct a security review of other endpoints for similar RBAC bypass vulnerabilities

Patch Information

OpenEMR version 8.0.0 addresses this vulnerability by implementing proper ACL checks using AclMain::aclCheckCore('acct', 'eob') before processing requests to the EDI log endpoint. The fix ensures that only users with explicit billing and EOB permissions can access the sensitive functionality.

The security patch is documented in the GitHub Security Advisory GHSA-rccq-vjfg-ggjh and the specific code changes are available in commit 1a57dfc.

Workarounds

• Implement web server access restrictions (e.g., Apache/Nginx rules) to block direct access to edih_main.php for non-administrative IPs
• Use a reverse proxy or WAF to enforce additional authentication requirements for billing endpoints
• Temporarily disable the EDI log viewing functionality at the web server level until patching is complete

# Apache configuration example - restrict access to billing endpoints
<Directory "/var/www/openemr/interface/billing">
    # Restrict access to trusted IP addresses until patch is applied
    Require ip 192.168.1.0/24
    Require ip 10.0.0.0/8
</Directory>