CVE-2026-25745: OpenEMR Auth Bypass Vulnerability

CVE-2026-25745 Overview

CVE-2026-25745 is an Insecure Direct Object Reference (IDOR) vulnerability affecting OpenEMR, a widely-used free and open source electronic health records (EHR) and medical practice management application. In versions up to and including 8.0.0, the message/note update endpoint (PUT or POST requests) processes updates based solely on the message/note ID without verifying that the message belongs to the current patient or that the authenticated user has permission to edit that patient's notes. This authorization bypass allows any authenticated user with notes permission to modify any patient's messages by simply supplying a different message ID.

Critical Impact

Authenticated attackers can manipulate sensitive patient medical records and communications, potentially leading to healthcare data integrity violations, HIPAA compliance breaches, and patient safety risks.

Affected Products

• OpenEMR versions up to and including 8.0.0
• open-emr openemr (all configurations)

Discovery Timeline

• 2026-03-18 - CVE-2026-25745 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-25745

Vulnerability Analysis

This vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), a form of Insecure Direct Object Reference (IDOR). The flaw exists in OpenEMR's message/note update functionality where the application fails to implement proper ownership verification before allowing modifications to patient records.

When an authenticated user submits a PUT or POST request to update a message or note, the application processes the request using only the provided message ID parameter. The backend logic does not cross-reference whether the requesting user has a legitimate relationship with the patient associated with that message ID. This missing authorization check creates a horizontal privilege escalation scenario where users can access and modify data belonging to other patients outside their authorized scope.

The vulnerability is particularly concerning in healthcare environments where data integrity is paramount. Unauthorized modification of patient messages could result in altered medical communications, tampered clinical notes, or corrupted healthcare records that could directly impact patient care decisions.

Root Cause

The root cause of this vulnerability lies in the MessageService.php component's failure to implement proper authorization checks before processing update operations. The service accepts a message ID as a direct object reference and processes the update without validating that:

1. The message belongs to a patient the current user is authorized to access
2. The current user has explicit permission to modify that specific patient's records

This design flaw violates the principle of least privilege and fails to enforce proper access control boundaries between patient records.

Attack Vector

The attack can be executed over the network by any authenticated user with basic notes permission. The attacker would:

1. Authenticate to OpenEMR with valid credentials that have notes permission
2. Identify or enumerate valid message IDs (potentially through other application features or predictable ID patterns)
3. Submit a PUT or POST request to the message/note update endpoint with a target message ID belonging to another patient
4. The application processes the update without authorization verification, modifying the victim patient's message

The vulnerability requires low attack complexity as it only requires crafting a simple HTTP request with an altered message ID parameter.

  * @link      http://www.open-emr.org
  * @author    Matthew Vita <matthewvita48@gmail.com>
  * @author    Brady Miller <brady.g.miller@gmail.com>
+ * @author    Michael A. Smith <michael@opencoreemr.com>
  * @copyright Copyright (c) 2018 Matthew Vita <matthewvita48@gmail.com>
  * @copyright Copyright (c) 2018 Brady Miller <brady.g.miller@gmail.com>
+ * @copyright Copyright (c) 2026 OpenCoreEMR Inc <https://opencoreemr.com/>
  * @license   https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
  */

Source: GitHub Commit Update

The patch adds proper ownership verification to ensure users can only modify messages associated with patients they are authorized to access.

Detection Methods for CVE-2026-25745

Indicators of Compromise

• Unexpected modifications to patient messages or notes that were not initiated by authorized personnel
• Audit log entries showing message updates by users who are not associated with the affected patient
• Anomalous patterns in HTTP logs showing PUT/POST requests to message endpoints with sequential or probed message IDs
• User accounts accessing or modifying records for patients outside their normal care scope

Detection Strategies

• Implement application-layer logging to capture all message/note update requests including user identity, patient ID, and message ID parameters
• Configure SIEM rules to alert on message modifications where the acting user has no prior documented relationship with the affected patient
• Deploy web application firewall rules to detect parameter manipulation attempts on message ID fields
• Monitor authentication logs for accounts making unusual volumes of message update requests

Monitoring Recommendations

• Enable detailed audit logging for all patient record modifications in OpenEMR
• Regularly review access logs for authorization boundary violations
• Implement real-time alerting for modifications to high-sensitivity patient records
• Conduct periodic access pattern analysis to identify potential IDOR exploitation attempts

How to Mitigate CVE-2026-25745

Immediate Actions Required

• Upgrade OpenEMR to a version containing commit 92a2ff9eaaa80674b3a934a6556e35e7aded5a41 or later
• Review audit logs for evidence of unauthorized message modifications
• Conduct a security assessment of other endpoints for similar IDOR vulnerabilities
• Notify affected patients if unauthorized access to their records is confirmed

Patch Information

The vulnerability has been addressed in commit 92a2ff9eaaa80674b3a934a6556e35e7aded5a41. Organizations running OpenEMR version 8.0.0 or earlier should apply this patch or upgrade to a patched release. Detailed patch information is available in the GitHub Security Advisory and the GitHub Commit.

Workarounds

• Restrict notes permission to only essential personnel until the patch can be applied
• Implement network-level access controls to limit which users can access the message/note update endpoints
• Deploy a web application firewall with custom rules to validate message ID ownership before allowing updates
• Enable enhanced audit logging to detect and respond to potential exploitation attempts

# Review OpenEMR audit logs for suspicious message modifications
grep -E "PUT|POST.*message|note" /var/log/apache2/openemr_access.log | \
  awk '{print $1, $4, $5, $6, $7}' | sort | uniq -c | sort -rn

# Check current OpenEMR version
cat /var/www/html/openemr/version.php | grep -i version