CVE-2026-33934: OpenEMR's Missing Authorization in show-signature.php Allows Portal Patients to Read Staff Signatures
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have a missing authorization check in portal/sign/lib/show-signature.php that allows any authenticated patient portal user to retrieve the drawn signature image of any staff member by supplying an arbitrary user value in the POST body. The companion write endpoint (save-signature.php) was already hardened against this same issue, but the read endpoint was not updated to match. Version 8.0.0.3 patches the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33934?
CVE-2026-33934 has a medium severity rating due to its potential for unauthorized access to sensitive signatures.
How do I fix CVE-2026-33934?
To fix CVE-2026-33934, update OpenEMR to version 8.0.0.3 or later which includes the necessary authorization checks.
Who is affected by CVE-2026-33934?
CVE-2026-33934 affects users of OpenEMR versions prior to 8.0.0.3 who utilize the patient portal.
What is the main issue with CVE-2026-33934?
The main issue with CVE-2026-33934 is a missing authorization check that allows portal patients to read staff signatures.
Is there a patch available for CVE-2026-33934?
Yes, a patch is available in OpenEMR version 8.0.0.3, which resolves the vulnerability.