Authorization Bypass in OpenEMR Affects Patient Portal Users

CVE-2026-33934

What is CVE-2026-33934?

OpenEMR, a widely used electronic health records and medical practice management application, is impacted by a flaw due to a missing authorization check in a specific endpoint. This vulnerability enables any authenticated user of the patient portal to access the drawn signature images of staff members without proper permission, simply by manipulating the user value in the POST request. Although the endpoint for saving signatures has been appropriately secured, the reading endpoint remains vulnerable. Users are advised to upgrade to version 8.0.0.3, which addresses and resolves this security issue.

References