Authentication Bypass Vulnerability in OpenEMR by OpenEMR

CVE-2026-33915

What is CVE-2026-33915?

OpenEMR, a widely-used electronic health records and medical practice management application, contains a significant vulnerability affecting its API. Specifically, prior to version 8.0.0.3, the application lacks essential authorization checks on five REST API routes related to insurance companies. This oversight allows any authenticated user of the API to create and alter sensitive insurance company records, circumventing the necessary administrative permissions that should have been enforced by the application. Users are highly encouraged to update to the patched version to secure their systems against potential misuse of this vulnerability.

References