What is CVE-2026-24890?

CVE-2026-24890 is a high-severity vulnerability in Open-Emr Openemr, classified under Improper Authorization. CVSS score: 8.1/10. Published 2026-02-25.

How severe is CVE-2026-24890?

High severity. CVSS v3 base score is 8.1 out of 10.

Auth bypass in Open-Emr Openemr

CVE-2026-24890

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an authorization bypass vulnerability in the patient portal signature endpoint allows authenticated portal users to upload and overwrite provider signatures by setting `type=admin-signature` and specifying any provider user ID. This could potentially lead to signature forgery on medical documents, legal compliance violations, and fraud. The issue occurs when portal users are allowed to modify provider signatures without proper authorization checks. Version 8.0.0 fixes the issue.

EPSS: 0.002 (15.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

Affected products

Open-emr Openemr
Openemr — versions < 8.0.0

Weakness classification (CWE)

CWE-285 — Improper Authorization

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2026-24890?: CVE-2026-24890 is a high-severity vulnerability in Open-Emr Openemr, classified under Improper Authorization. CVSS score: 8.1/10. Published 2026-02-25.
How severe is CVE-2026-24890?: High severity. CVSS v3 base score is 8.1 out of 10.