Broken Access Control in OpenEMR Affects User Profile Management
CVE-2025-67645

8.8HIGH

Key Information:

Vendor

Openemr

Status
Openemr
Vendor
CVE Published:
27 January 2026

What is CVE-2025-67645?

OpenEMR, a widely used electronic health record and medical practice management application, is susceptible to a broken access control vulnerability in the Profile Edit endpoint. This issue affects versions prior to 7.0.4 and allows authenticated users to manipulate request parameters, leading to unauthorized modifications of other users' profile data, such as personal details and contact information. If exploited, this vulnerability can facilitate account takeovers, putting sensitive health information at risk. Users are urged to upgrade to version 7.0.4 or later to safeguard against this exploitation.

Affected Version(s)

openemr < 7.0.4

References

https://github.com/openemr/openemr/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/openemr/openemr/commit/e2a682ee71aac71...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.