CVE-2026-33304
Authorization Bypass in OpenEMR Allows Unauthorized Reminder Access
Publication date: 2026-03-19
Last updated on: 2026-03-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| open-emr | openemr | to 8.0.0.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-33304 is an authorization bypass vulnerability in OpenEMR versions prior to 8.0.0.2 affecting the dated reminders log feature.'}, {'type': 'paragraph', 'content': 'This vulnerability allows any authenticated non-admin user to view reminder messages that belong to other users by manipulating the GET request parameters `sentTo[]` or `sentBy[]` with arbitrary user IDs.'}, {'type': 'paragraph', 'content': "The system was intended to restrict non-admin users to only see their own reminders, but the authorization check only applied if both parameters were absent. If a user supplied either parameter, the check was bypassed, allowing access to other users' reminders."}, {'type': 'paragraph', 'content': 'As a result, sensitive information such as patient names and free-text message content could be accessed by unauthorized users.'}] [1]
How can this vulnerability impact me? :
This vulnerability can impact you by exposing Protected Health Information (PHI) to any authenticated non-admin user.
An attacker or unauthorized user can view reminder messages belonging to other users, including sensitive patient names and free-text message content.
Attackers can enumerate reminders across all users by iterating over user IDs, potentially gaining access to a large amount of sensitive data.
Although the vulnerability is read-only and does not allow modification or deletion of data, the confidentiality of sensitive health information is compromised.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by attempting to access the dated reminders log with crafted GET requests that include arbitrary user IDs in the `sentTo[]` or `sentBy[]` parameters as a non-admin authenticated user.'}, {'type': 'paragraph', 'content': "A practical detection method involves logging in as a non-admin user and issuing a GET request to the endpoint `/interface/main/dated_reminders/dated_reminders_log.php` with the `csrf_token_form` parameter and either `sentTo[]` or `sentBy[]` set to another user's ID."}, {'type': 'list_item', 'content': "Example curl command to test access to another user's reminders (replace `<token>` and `<user_id>` accordingly):"}, {'type': 'list_item', 'content': 'curl -b cookies.txt "https://<openemr-host>/interface/main/dated_reminders/dated_reminders_log.php?csrf_token_form=<token>&sentTo[]=<user_id>"'}, {'type': 'list_item', 'content': 'Similarly, test with `sentBy[]` parameter:'}, {'type': 'list_item', 'content': 'curl -b cookies.txt "https://<openemr-host>/interface/main/dated_reminders/dated_reminders_log.php?csrf_token_form=<token>&sentBy[]=<user_id>"'}, {'type': 'paragraph', 'content': "If the response contains reminder messages, patient names, or other users' data, the vulnerability is present."}] [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade OpenEMR to version 8.0.0.2 or later, where the vulnerability is fixed by enforcing proper authorization checks on the `sentBy` and `sentTo` parameters.
Until the upgrade can be applied, restrict access to the dated reminders log page for non-admin users or implement network-level controls to prevent unauthorized crafted GET requests.
Additionally, monitor and audit access logs for suspicious requests containing `sentBy[]` or `sentTo[]` parameters with arbitrary user IDs.