CVE-2026-44715: OpenMRS Authentication Bypass Vulnerability

CVE-2026-44715 Overview

CVE-2026-44715 is an improper authorization vulnerability [CWE-285] in OpenMRS, an open source electronic medical record system platform. The flaw affects OpenMRS versions prior to 1.23.0 and 2.10.0. Any authenticated user can invoke administrative Direct Web Remoting (DWR) services that should be restricted to administrator accounts. Specifically, the startHl7ArchiveMigration method is exposed to non-admin users. An attacker with valid low-privileged credentials can trigger administrative operations on the electronic medical record system. Versions 1.23.0 and 2.10.0 correct the authorization checks.

Critical Impact

Authenticated non-admin users can trigger administrative DWR services in OpenMRS, including the HL7 archive migration routine, leading to unauthorized changes in a healthcare records platform.

Affected Products

• OpenMRS Core versions prior to 1.23.0 (1.x branch)
• OpenMRS Core versions prior to 2.10.0 (2.x branch)
• Deployments exposing DWR endpoints to authenticated users

Discovery Timeline

• 2026-09-11 - CVE-2026-44715 published to NVD
• 2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-44715

Vulnerability Analysis

OpenMRS uses Direct Web Remoting (DWR) to expose server-side Java methods as callable endpoints for browser clients. The startHl7ArchiveMigration method is one such DWR-exposed operation that manages HL7 message archive migration, an administrative maintenance task. The framework enforces authorization on a per-method basis. The vulnerable versions fail to require administrator privileges for this method. An authenticated user with any role can therefore submit a DWR request that starts the archive migration. The impact is bounded to integrity, as the operation modifies system state rather than exfiltrating patient data.

Root Cause

The root cause is a missing or misconfigured authorization check on the startHl7ArchiveMigration DWR method [CWE-285]. The method inherits the default authenticated-user access policy instead of the administrator-only policy required for privileged maintenance operations. See the GitHub Security Advisory GHSA-g7rc-8fr4-5p2p for the upstream analysis.

Attack Vector

Exploitation requires network access to the OpenMRS web interface and valid credentials for any authenticated account, including low-privileged clinician or data entry users. The attacker sends a DWR call targeting the startHl7ArchiveMigration method through the standard /dwr/ endpoint. No user interaction from an administrator is required. Because DWR calls occur over standard HTTP(S), the requests blend into normal application traffic. The vulnerability does not require exploitation of memory corruption or complex chaining.

No verified public proof-of-concept code is available. Refer to the OpenMRS security advisory for technical details.

Detection Methods for CVE-2026-44715

Indicators of Compromise

• DWR POST requests to /dwr/call/plaincall/ or similar DWR endpoints referencing startHl7ArchiveMigration from non-administrator session identifiers.
• Unexpected entries in OpenMRS application logs indicating HL7 archive migration jobs starting outside scheduled maintenance windows.
• Authenticated sessions belonging to non-admin users generating requests to administrative DWR service methods.

Detection Strategies

• Review OpenMRS access logs and correlate DWR method invocations with the calling user's role to flag privilege mismatches.
• Enable verbose DWR logging in staging environments to enumerate which methods are being called by which user roles.
• Alert on any invocation of startHl7ArchiveMigration and validate that the initiating account holds administrator privileges.

Monitoring Recommendations

• Forward OpenMRS application and web server logs to a centralized SIEM for role-based correlation of administrative actions.
• Baseline normal DWR traffic per user role and alert on deviations, particularly non-admin accounts hitting admin methods.
• Monitor HL7 archive tables and migration job state for changes that were not initiated by scheduled maintenance.

How to Mitigate CVE-2026-44715

Immediate Actions Required

• Upgrade OpenMRS Core to version 1.23.0 (for 1.x deployments) or 2.10.0 (for 2.x deployments) as soon as possible.
• Audit user accounts and revoke unused or dormant credentials that could be leveraged by an attacker with stolen sessions.
• Review recent HL7 archive migration activity and confirm each execution maps to an authorized administrator.

Patch Information

OpenMRS addressed the improper authorization in versions 1.23.0 and 2.10.0 by restricting startHl7ArchiveMigration and related administrative DWR services to administrator-level accounts. Deployment details and code changes are documented in the GitHub Security Advisory GHSA-g7rc-8fr4-5p2p.

Workarounds

• Restrict network access to the OpenMRS /dwr/ endpoints using a reverse proxy or web application firewall until patching completes.
• Temporarily disable or rename the vulnerable DWR service in the DWR configuration if patching cannot be performed immediately.
• Enforce strong authentication and multi-factor authentication on all OpenMRS accounts to raise the barrier for opportunistic exploitation.

# Configuration example: block non-admin access to DWR admin methods at the reverse proxy
# nginx snippet - deny DWR calls referencing the vulnerable method
location /openmrs/dwr/ {
    if ($request_body ~* "startHl7ArchiveMigration") {
        return 403;
    }
    proxy_pass http://openmrs_backend;
}