CVE-2026-44715

Received Received - Intake

Authenticated DWR Access in OpenMRS

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: GitHub, Inc.

Description

OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR services. Specifically, the `startHl7ArchiveMigration` method is accessible, which should be restricted to admin-level accounts. Versions 1.23.0 and 2.10.0 patch the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-44715

Affected Vendors & Products

Vendor	Product	Version / Range
openmrs	openmrs	to 1.23.0 (exc)
openmrs	openmrs	to 2.10.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in OpenMRS allows an authenticated user to trigger administrative DWR services, specifically the startHl7ArchiveMigration method, which should only be accessible to admin-level accounts. This improper access control could let non-admin users perform administrative actions.

Detection Guidance

Detection requires checking for unauthorized access to the OpenMRS DWR service methods. Verify if non-admin users can trigger the startHl7ArchiveMigration method. Check OpenMRS logs for suspicious administrative service calls. Ensure only admin accounts have access to these methods.

Impact Analysis

An attacker could exploit this to perform unauthorized administrative actions, potentially compromising the integrity of the medical record system. This could lead to data breaches, unauthorized modifications, or system disruptions affecting patient care.

Compliance Impact

This vulnerability could violate compliance with GDPR and HIPAA by allowing unauthorized access to sensitive patient data. It undermines data integrity and confidentiality requirements, potentially leading to legal penalties and loss of trust.

Mitigation Strategies

Upgrade OpenMRS to version 1.23.0 or 2.10.0 or later to patch the vulnerability. Ensure only admin-level accounts have access to DWR services and review user permissions.

Hi! I’m here to help you understand CVE-2026-44715. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70