CVE-2026-40509: OpenEMR DICOM Viewer CSRF Vulnerability

CVE-2026-40509 Overview

CVE-2026-40509 is a Cross-Site Request Forgery [CWE-352] vulnerability in OpenEMR versions before 8.3.0. The flaw exists in the DICOM viewer component, where the web_path GET parameter is embedded unsanitized as a URL. OpenEMR does not validate the parameter against expected path formats. An attacker can craft a malicious URL that causes an authenticated user with Patients - Documents permissions to issue authenticated requests to arbitrary OpenEMR endpoints. This enables forced logout and other state-changing actions on behalf of the victim.

Critical Impact
Attackers can force authenticated OpenEMR users to invoke arbitrary endpoints, triggering unwanted state changes such as forced logout through CSRF exploitation of the DICOM viewer.

Affected Products

OpenEMR versions prior to 8.3.0
OpenEMR DICOM viewer module (web_path GET parameter)
OpenEMR deployments granting users Patients - Documents permissions

Discovery Timeline

2026-08-19 - CVE-2026-40509 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-40509

Vulnerability Analysis

The vulnerability originates in the OpenEMR DICOM viewer page. The web_path GET parameter is reflected into the page as a URL without validation of its format or origin. Because the parameter is not constrained to expected DICOM asset paths, an attacker can point it to any OpenEMR endpoint.

When a victim with Patients - Documents permissions loads a crafted link, the browser issues authenticated requests to the attacker-specified endpoint using the victim's session. OpenEMR performs the action without verifying that the request originated from a trusted context. This produces classic CSRF behavior, allowing state-changing actions such as forced logout of the authenticated user.

Root Cause

The root cause is missing CSRF protection combined with unvalidated input on GET requests. The DICOM viewer accepts a client-controlled URL parameter and lacks a per-request CSRF token check. Sensitive state-changing endpoints reachable through this vector do not enforce origin or token validation.

Attack Vector

Exploitation is remote and requires user interaction. The attacker delivers a crafted URL to an authenticated OpenEMR user through phishing, chat, or an embedded link. When the victim visits the URL, their browser transmits session cookies and the request is processed as legitimate. No credentials or elevated privileges are required for the attacker.

php

// Patch: interface/modules/custom_modules/oe-module-weno/scripts/file_download.php
 require_once dirname(__DIR__, 4) . "/globals.php";

 use OpenEMR\BC\ServiceContainer;
+use OpenEMR\Common\Acl\AclMain;
+use OpenEMR\Common\Csrf\CsrfUtils;
 use OpenEMR\Common\Logging\EventAuditLogger;
 use OpenEMR\Common\Session\SessionWrapperFactory;
 use OpenEMR\Core\OEGlobalsBag;

Source: GitHub Commit f760adc. The fix imports CsrfUtils and AclMain to enforce CSRF token validation and access control on GET requests that previously lacked it.

Detection Methods for CVE-2026-40509

Indicators of Compromise

Unexpected requests to the OpenEMR DICOM viewer containing external or unusual values in the web_path GET parameter.
HTTP referrer headers on OpenEMR endpoints pointing to untrusted third-party domains.
Spikes in authenticated user logout events immediately following a document or DICOM viewer access.
Session termination events correlated with users clicking external links in email or chat.

Detection Strategies

Inspect web server access logs for web_path parameter values that reference OpenEMR endpoints other than legitimate DICOM asset paths.
Alert on OpenEMR state-changing GET requests that lack a valid CSRF token or arrive with an off-domain Referer.
Correlate document-viewer access with subsequent forced logout or configuration-change events on the same session.

Monitoring Recommendations

Enable OpenEMR audit logging and forward events to a centralized SIEM for correlation across sessions and users.
Monitor accounts with Patients - Documents permissions for anomalous access patterns to the DICOM viewer.
Track outbound-linked domains embedded in emails to OpenEMR clinicians and flag those that point to internal OpenEMR URLs.

How to Mitigate CVE-2026-40509

Immediate Actions Required

Upgrade all OpenEMR instances to version 8.3.0 or later, which introduces CSRF checks on the affected GET endpoints.
Review and reduce the population of users assigned Patients - Documents permissions to the minimum required.
Educate clinicians and staff on the risk of clicking untrusted links while authenticated to OpenEMR.

Patch Information

The fix is delivered in OpenEMR release v8.3.0 and referenced in GHSA-wffp-pj5h-xqwp. The patch commit f760adc7 incorporates CsrfUtils validation into GET request handlers. Additional context is available in the VulnCheck advisory.

Workarounds

Restrict access to the OpenEMR web interface via VPN or IP allowlisting until upgrade is complete.
Enforce SameSite=Strict on OpenEMR session cookies at the web server or application layer to reduce cross-site request effectiveness.
Deploy a web application firewall rule that blocks requests to the DICOM viewer where web_path contains OpenEMR endpoint paths rather than DICOM asset URLs.

bash

# Example WAF pattern to reject suspicious web_path values on the DICOM viewer
# Reject requests where web_path references internal OpenEMR endpoints
SecRule ARGS:web_path "@rx (?i)(interface/|main\.php|logout|admin)" \
    "id:1040509,phase:2,deny,status:403,\
     msg:'CVE-2026-40509 - Suspicious web_path parameter in DICOM viewer'"