Executive Summary

CVE-2026-25127 is a high-severity Broken Access Control vulnerability in OpenEMR versions prior to 8.0.0, specifically affecting the Care Coordination module.

The server does not properly validate user permissions, which allows unauthorized users to access sensitive information intended only for authorized roles.

An attacker with a low-privilege account can exploit this by manipulating session cookies to bypass access control restrictions and view data they should not have access to.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can severely impact the confidentiality of sensitive data within OpenEMR systems.

• Unauthorized users can view sensitive patient coordination data without proper permissions.
• Attackers only need low-privilege credentials and no user interaction to exploit this remotely.

Integrity and availability of the system are not affected by this vulnerability.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to access the Care Coordination module data using a low-privilege user account that should not have access. Specifically, one can capture HTTP requests made by an Administrator user to the Care Coordination module and then replay those requests using the session cookie of a low-privilege user (such as an Accounting role user). If the server improperly allows access to the data despite the lower privileges, the vulnerability is present.

Commands or steps to detect this include:

• Log in as an Administrator and capture HTTP requests to the Care Coordination module URL (e.g., using tools like curl, Burp Suite, or browser developer tools).
• Log in as a low-privilege user (e.g., accountant) and obtain their session cookie.
• Modify the captured Administrator HTTP request by replacing the Administrator session cookie with the low-privilege user’s session cookie.
• Send the modified request to the server and observe if the low-privilege user can access the Care Coordination data.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade OpenEMR to version 8.0.0 or later, where this broken access control issue has been fixed.

Until the upgrade can be performed, consider restricting access to the Care Coordination module by network controls or disabling the module for low-privilege users to prevent unauthorized access.

Additionally, monitor and audit user access logs for any suspicious activity involving the Care Coordination module.

Useful 0 Not Useful 0