Administrative Access Vulnerability in OpenMRS Electronic Medical Record System

CVE-2026-44715

What is CVE-2026-44715?

OpenMRS, an open-source electronic medical record system platform, has a vulnerability that allows authenticated users to trigger administrative Direct Web Remoting (DWR) services. Specifically, the 'startHl7ArchiveMigration' method is improperly accessible to non-admin accounts. This oversight poses a significant security risk, as it enables unauthorized users to perform actions intended solely for administrative personnel. The vulnerability has been patched in versions 1.23.0 and 2.10.0, which restrict access to this critical administrative functionality.

References