CVE-2026-25131: OpenEMR has Broken Access Control in Procedures Configuration
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a Broken Access Control vulnerability exists in the OpenEMR order types management system, allowing low-privilege users (such as Receptionist) to add and modify procedure types without proper authorization. This vulnerability is present in the /openemr/interface/orders/typesedit.php endpoint. Version 8.0.0 contains a patch.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25131?
CVE-2026-25131 has a high severity rating due to its impact on access control within the OpenEMR system.
How do I fix CVE-2026-25131?
To fix CVE-2026-25131, upgrade your OpenEMR application to version 8.0.0 or later.
What type of vulnerability is CVE-2026-25131?
CVE-2026-25131 is categorized as a Broken Access Control vulnerability in OpenEMR.
What are the potential implications of CVE-2026-25131?
The implications of CVE-2026-25131 include unauthorized access to sensitive medical records and procedures in the OpenEMR system.
Which versions of OpenEMR are affected by CVE-2026-25131?
OpenEMR versions prior to 8.0.0 are affected by CVE-2026-25131.