CVE-2026-25929 openemr CVE debrief

Who should care

Defenders of OpenEMR installations should assess exposure and apply the patch, as the vulnerability allows unauthorized access to patient photos. This includes OpenEMR administrators, security teams, and IT personnel responsible for maintaining and securing OpenEMR systems. Additionally, healthcare organizations using OpenEMR should verify that their installations are up-to-date and patched to prevent potential privacy breaches.

Why it matters

CVE-2026-25929 allows unauthorized access to patient photos in OpenEMR. Defenders should verify exposure, apply the patch, and restrict access to patient photos based on document ACL.

• Verify patient photo access controls to prevent unauthorized access
• Restrict document ACL to authorized users only

Technical summary

The document controller's `patient_picture` context in OpenEMR serves the patient's photo by document ID or patient ID without verifying that the current user is authorized to access that patient. An authenticated user with document ACL can supply another patient's ID and retrieve their photo. This vulnerability is due to a lack of proper authorization checks in the `patient_picture` context. The issue was addressed in version 8.0.0 by adding proper authorization checks. Defenders should prioritize verifying exposure and applying the patch.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, as the vulnerability allows unauthorized access to patient photos.

Recommended defensive actions

• Verify exposure by checking if the current version is prior to 8.0.0
• Apply the patch by upgrading to version 8.0.0 or later
• Restrict access to patient photos based on document ACL
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is described in the CVE record and NVD vulnerability detail page. The issue is fixed in version 8.0.0. Evidence of exploitation is not provided, but defenders should verify exposure and apply the patch. The CVE record was published on 2026-02-25T19:43:22.930Z and has not been modified since then. The NVD vulnerability detail page provides additional information on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.