Vulnerability in OpenEMR Affects Medical Data Sensitivity Controls
CVE-2026-32123

7.7HIGH

Key Information:

Vendor

Openemr

Status
Openemr
Vendor
CVE Published:
11 March 2026

What is CVE-2026-32123?

A flaw in OpenEMR prior to version 8.0.0.1 compromises data sensitivity checks for group encounters. The application fails to appropriately restrict access based on sensitivity levels associated with group encounters, allowing unauthorized users to view sensitive medical information, such as mental health records. This issue arises because the system only references form_encounter for sensitivity, neglecting to check the sensitivities stored in form_groups_encounter, which leads to potential breaches of patient privacy.

Affected Version(s)

openemr < 8.0.0.1

References

https://github.com/openemr/openemr/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.