CVE-2026-33918: OpenEMR Auth Bypass Vulnerability

CVE-2026-33918 Overview

CVE-2026-33918 is a Missing Authorization vulnerability affecting OpenEMR, a free and open source electronic health records (EHR) and medical practice management application. The vulnerability exists in the billing file-download endpoint interface/billing/get_claim_file.php, which only verifies that the caller has a valid session and CSRF token but fails to check any ACL (Access Control List) permissions. This authorization bypass allows any authenticated OpenEMR user—regardless of whether they have billing privileges—to download and permanently delete electronic claim batch files containing protected health information (PHI).

Critical Impact

Any authenticated user can access and delete sensitive PHI billing data without proper authorization, potentially violating HIPAA compliance and exposing patient information.

Affected Products

• OpenEMR versions prior to 8.0.0.3
• OpenEMR installations using the billing module with electronic claims processing
• Healthcare organizations using OpenEMR for medical practice management

Discovery Timeline

• 2026-03-26 - CVE-2026-33918 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33918

Vulnerability Analysis

This vulnerability represents a classic Broken Access Control (CWE-862: Missing Authorization) flaw in a healthcare application. The affected endpoint interface/billing/get_claim_file.php performs session validation and CSRF token verification—which protects against session hijacking and cross-site request forgery attacks—but critically omits the ACL permission check that should restrict access to users with billing privileges.

In a properly secured OpenEMR installation, access to billing files should be limited to users with specific roles such as Billing Manager or users with acct/eob or acct/bill write permissions. The absence of this check means that any user who can authenticate to the OpenEMR instance (including users with minimal privileges like front-desk staff or limited clinical roles) can access sensitive billing data.

The impact is severe because electronic claim batch files typically contain PHI including patient names, dates of birth, Social Security numbers, medical procedure codes, diagnosis codes, and insurance information. Unauthorized access to or deletion of these files can result in HIPAA violations, compliance penalties, and disruption of revenue cycle operations.

Root Cause

The root cause is the missing ACL permission verification in the get_claim_file.php endpoint. The developers implemented CSRF protection but overlooked the authorization layer that should enforce role-based access control. This is a common oversight when developers focus on one security control while neglecting others in the defense-in-depth model.

Attack Vector

An attacker exploiting this vulnerability would need valid credentials for any user account in the target OpenEMR system. Once authenticated, they could directly access the billing endpoint to download or delete claim files without requiring any billing-related permissions. The attack can be conducted remotely over the network with low complexity, requiring no user interaction beyond the initial authentication.

// Security patch adding ACL checks to interface/billing/get_claim_file.php
// Source: https://github.com/openemr/openemr/commit/f6d98d0102df0a8f131be560d9208fb65fba6188

 require_once(__DIR__ . "/../globals.php");
 require_once $GLOBALS['OE_SITE_DIR'] . "/config.php";
 
+use OpenEMR\Common\Acl\AccessDeniedHelper;
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
 
+if (!AclMain::aclCheckCore('acct', 'eob', '', 'write') && !AclMain::aclCheckCore('acct', 'bill', '', 'write')) {
+    AccessDeniedHelper::denyWithTemplate("ACL check failed for acct/eob or acct/bill: Billing Manager", xl("Billing Manager"));
+}
+
 if (!CsrfUtils::verifyCsrfToken($_GET["csrf_token_form"])) {
     CsrfUtils::csrfNotVerified();
 }

Source: GitHub Commit f6d98d0

Detection Methods for CVE-2026-33918

Indicators of Compromise

• Unusual access patterns to /interface/billing/get_claim_file.php from user accounts without billing roles
• HTTP requests to the billing download endpoint from users who have never accessed billing functions
• Unexpected deletion of electronic claim batch files from the claims directory
• Audit log entries showing billing file access by non-billing personnel

Detection Strategies

• Implement web application firewall (WAF) rules to monitor and alert on access to billing endpoints
• Review OpenEMR access logs for requests to get_claim_file.php and correlate with user role assignments
• Configure SIEM rules to detect anomalous file access patterns in the billing module
• Enable verbose logging for the billing subsystem to capture all file operations

Monitoring Recommendations

• Establish baseline patterns of legitimate billing endpoint usage and alert on deviations
• Monitor for bulk downloads or repeated access to claim files from single sessions
• Implement file integrity monitoring on directories containing electronic claim batches
• Review user account permissions regularly to ensure principle of least privilege

How to Mitigate CVE-2026-33918

Immediate Actions Required

• Upgrade OpenEMR to version 8.0.0.3 or later immediately
• Audit recent access logs for the billing download endpoint to identify potential unauthorized access
• Review all user accounts and ensure billing permissions are properly configured
• Notify compliance officers if unauthorized PHI access is detected

Patch Information

OpenEMR has released version 8.0.0.3 which addresses this vulnerability by adding proper ACL checks to the billing file download endpoint. The patch implements authorization verification using AclMain::aclCheckCore() to ensure only users with acct/eob or acct/bill write permissions can access the endpoint. Organizations should download the patched version from the official OpenEMR release.

For detailed information about the security fix, refer to the GitHub Security Advisory GHSA-g3p5-5grq-m65m.

Workarounds

• Restrict network access to the OpenEMR billing module at the web server level using IP allowlists
• Implement additional authentication requirements for billing endpoints through reverse proxy configuration
• Temporarily disable the electronic claims download functionality if immediate patching is not possible
• Enable enhanced audit logging to detect any exploitation attempts while planning the upgrade

# Apache configuration to restrict billing endpoint access by IP
<Location "/interface/billing/get_claim_file.php">
    Require ip 10.0.0.0/8
    Require ip 192.168.1.0/24
</Location>