CVE-2026-25929: OpenEMR Auth Bypass Vulnerability

CVE-2026-25929 Overview

OpenEMR, a widely-used free and open source electronic health records (EHR) and medical practice management application, contains an Insecure Direct Object Reference (IDOR) vulnerability in its document controller. Prior to version 8.0.0, the patient_picture context serves patient photos by document ID or patient ID without verifying that the current user is authorized to access that specific patient's records. This authorization bypass allows an authenticated user with document ACL permissions to retrieve photos belonging to other patients by simply supplying their patient ID.

Critical Impact
Authenticated attackers can access protected health information (PHI) including patient photographs without proper authorization, potentially violating HIPAA regulations and patient privacy.

Affected Products

OpenEMR versions prior to 8.0.0
Healthcare organizations using vulnerable OpenEMR installations
Any deployment utilizing the document controller's patient_picture functionality

Discovery Timeline

2026-02-25 - CVE CVE-2026-25929 published to NVD
2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-25929

Vulnerability Analysis

This vulnerability represents a classic Insecure Direct Object Reference (IDOR) flaw categorized as CWE-639 (Authorization Bypass Through User-Controlled Key). The document controller in OpenEMR fails to implement proper access control checks when serving patient photographs through the patient_picture context.

The core issue lies in the application's trust of user-supplied identifiers without validating whether the requesting user has legitimate access to the referenced patient's data. In healthcare applications, this type of vulnerability is particularly severe as it directly impacts protected health information under HIPAA regulations.

The vulnerability can be exploited over the network by any authenticated user who possesses document ACL permissions, regardless of their actual patient assignment or role-based access restrictions. No user interaction is required for exploitation, and the attack can result in unauthorized disclosure of confidential patient photographs.

Root Cause

The root cause stems from missing authorization validation in the C_Document.class.php controller. When processing requests for patient pictures, the controller accepts patient ID or document ID parameters directly from user input and retrieves the corresponding image without checking if the authenticated user has permission to view that specific patient's records.

The vulnerable code path allows any authenticated user with basic document permissions to bypass the intended patient-level access controls by manipulating the request parameters to reference other patients' identifiers.

Attack Vector

An attacker with valid authentication credentials and document ACL access can exploit this vulnerability through the following attack flow:

Authenticate to the OpenEMR application with valid credentials
Navigate to or craft a request to the document controller's patient_picture endpoint
Modify the patient ID parameter to reference another patient's identifier
The server returns the targeted patient's photograph without authorization verification
Repeat with different patient IDs to enumerate and extract additional patient photos

The security patch adds proper authorization checks and audit logging to prevent unauthorized access:

php

use OpenEMR\Common\Crypto\CryptoGen;
use OpenEMR\Common\Csrf\CsrfUtils;
use OpenEMR\Common\Database\QueryUtils;
+use OpenEMR\Common\Logging\EventAuditLogger;
use OpenEMR\Common\Logging\SystemLogger;
use OpenEMR\Common\Twig\TwigContainer;
use OpenEMR\Common\Session\SessionWrapperFactory;

Source: GitHub Commit fc4d00ecb63561dacd23cb1fed49c64bd1a83258

Detection Methods for CVE-2026-25929

Indicators of Compromise

Unusual patterns of patient photo requests from single user sessions accessing multiple unrelated patients
Access logs showing sequential or enumerated patient ID requests to the patient_picture endpoint
Audit trail anomalies where users view patient records they are not assigned to
High-volume requests to the document controller from individual authenticated sessions

Detection Strategies

Implement log analysis rules to detect users accessing patient records outside their normal care assignments
Monitor for unusual access patterns to the patient_picture endpoint including parameter enumeration
Deploy application-layer anomaly detection for the document controller endpoints
Review access logs for authenticated users requesting patient IDs in sequential or bulk patterns

Monitoring Recommendations

Enable comprehensive audit logging for all patient record access including photo retrieval
Configure alerts for access attempts to patient records outside assigned care relationships
Implement real-time monitoring of document controller access patterns
Establish baseline metrics for normal patient photo access frequency per user role

How to Mitigate CVE-2026-25929

Immediate Actions Required

Upgrade OpenEMR to version 8.0.0 or later immediately
Conduct audit review of patient photo access logs to identify potential exploitation
Verify all users with document ACL permissions have appropriate access levels
Implement network-level access restrictions to OpenEMR administration interfaces

Patch Information

OpenEMR has addressed this vulnerability in version 8.0.0. The fix adds proper authorization validation to ensure users can only access patient photographs for patients they are explicitly authorized to view. Additionally, the patch includes enhanced audit logging through the EventAuditLogger to track access attempts.

For detailed patch information, refer to:

Workarounds

Restrict document ACL permissions to only essential personnel until patching is complete
Implement web application firewall rules to monitor and limit access to the patient_picture endpoint
Enable enhanced access logging on the document controller to detect exploitation attempts
Consider temporary network segmentation to limit exposure of vulnerable OpenEMR instances

bash

# Configuration example - Restrict access to document controller endpoints
# Add to Apache configuration or .htaccess for OpenEMR
<Location "/openemr/controller.php">
    # Require specific IP ranges for document access
    Require ip 10.0.0.0/8 192.168.0.0/16
    # Enable detailed access logging
    CustomLog /var/log/openemr/document_access.log combined
</Location>