Access Control Vulnerability in OpenEMR by OpenEMR
CVE-2026-33918
What is CVE-2026-33918?
OpenEMR, a widely used open-source electronic health records and medical practice management application, has a significant vulnerability affecting all versions prior to 8.0.0.3. This vulnerability lies in the billing file-download functionality, specifically within the interface/billing/get_claim_file.php endpoint. It allows any authenticated user to download and potentially delete electronic claim batch files that contain protected health information (PHI), without proper verification of access control list (ACL) permissions. Users with no billing privileges can exploit this flaw, posing serious risks to data confidentiality and integrity. The issue has been addressed in version 8.0.0.3.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
openemr < 8.0.0.3