CVE-2026-25131 HIGH

CVE-2026-25131: OpenEMR has Broken Access Control in Procedures Configuration

Vendor Openemr
Product openemr
Weakness CWE-862 · Missing authorization
Published February 25, 2026
Last update February 25, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a Broken Access Control vulnerability exists in the OpenEMR order types management system, allowing low-privilege users (such as Receptionist) to add and modify procedure types without proper authorization. This vulnerability is present in the /openemr/interface/orders/types_edit.php endpoint. Version 8.0.0 contains a patch.

Key dates

02Disclosure timeline

February 25, 2026 CVE published
February 25, 2026 Record updated