CVE-2026-33918: OpenEMR Missing Authorization on Claim File Download Endpoint
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the billing file-download endpoint interface/billing/getclaimfile.php only verifies that the caller has a valid session and CSRF token, but does not check any ACL permissions. This allows any authenticated OpenEMR user — regardless of whether they have billing privileges — to download and permanently delete electronic claim batch files containing protected health information (PHI). Version 8.0.0.3 patches the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33918?
CVE-2026-33918 is classified as a critical vulnerability due to its potential for unauthorized access to sensitive billing information.
How do I fix CVE-2026-33918?
To fix CVE-2026-33918, upgrade OpenEMR to version 8.0.0.3 or later, which includes the necessary authorization checks.
What impact does CVE-2026-33918 have on OpenEMR users?
CVE-2026-33918 allows unauthorized users to download healthcare billing files, potentially leading to data breaches.
Is CVE-2026-33918 only present in specific versions of OpenEMR?
Yes, CVE-2026-33918 affects all versions of OpenEMR prior to 8.0.0.3.
What does the missing authorization in CVE-2026-33918 refer to?
The missing authorization in CVE-2026-33918 refers to the lack of verification that ensures only authorized users can access the claim file download endpoint.