What is CVE-2026-25164?

CVE-2026-25164 is a high-severity vulnerability in Open-Emr Openemr, classified under Missing Authorization. CVSS score: 8.1/10. Published 2026-02-25.

How severe is CVE-2026-25164?

High severity. CVSS v3 base score is 8.1 out of 10.

Auth bypass in Open-Emr Openemr

CVE-2026-25164

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the REST API route table in `apis/routes/_rest_routes_standard.inc.php` does not call `RestConfig::request_authorization_check()` for the document and insurance routes. Other patient routes in the same file (e.g. encounters, patients/med) call it with the appropriate ACL. As a result, any valid API bearer token can access or modify every patient's documents and insurance data, regardless of the token’s OpenEMR ACLs—effectively exposing all document and insurance PHI to any authenticated API client. Version 8.0.0 patches the issue.

Vulnerability class: Broken Access Control

EPSS: 0.003 (17.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

Affected products

Open-emr Openemr
Openemr — versions < 8.0.0

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2026-25164?: CVE-2026-25164 is a high-severity vulnerability in Open-Emr Openemr, classified under Missing Authorization. CVSS score: 8.1/10. Published 2026-02-25.
How severe is CVE-2026-25164?: High severity. CVSS v3 base score is 8.1 out of 10.