CVE-2026-27943: OpenEMR's Eye Exam View Trusts form_id Without Verifying Patient/Encounter Ownership
OpenEMR is a free and open source electronic health records and medical practice management application. In versions up to and including 8.0.0, the eye exam (eyemag) view loads data by formid (or equivalent) without verifying that the form belongs to the current user’s patient/encounter context. An authenticated user can access or edit any patient’s eye exam by supplying another form ID; in some flows the session’s active patient may also be switched. A fix is available on the main branch of the OpenEMR GitHub repository.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27943?
The severity of CVE-2026-27943 has not been explicitly stated, but it involves unauthorized data access due to improper validation.
How do I fix CVE-2026-27943?
To fix CVE-2026-27943, upgrade OpenEMR to the latest version beyond 8.0.0 that addresses this vulnerability.
What versions of OpenEMR are affected by CVE-2026-27943?
OpenEMR versions up to and including 8.0.0 are affected by CVE-2026-27943.
What type of vulnerability is CVE-2026-27943?
CVE-2026-27943 is an access control vulnerability that allows the eye exam view to trust unverified form IDs.
How can CVE-2026-27943 impact patient data security?
CVE-2026-27943 can potentially allow unauthorized users to access or manipulate patient encounter data, threatening patient confidentiality.