Vulnerability · Published Feb 25, 2026 · Assigned by GitHub_M

CVE-2026-25929OpenEMR Patient Picture Context Allows Arbitrary Patient Photo Retrieval

Medium 6.5

In plain English

A medium-severity authorization bypass via user-controlled key in openemr from openemr. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 77.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the document controller’s `patient_picture` context serves the patient’s photo by document ID or patient ID without verifying that the current user is authorized to access that patient. An authenticated user with document ACL can supply another patient’s ID and retrieve their photo. Version 8.0.0 fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
openemr	openemr	< 8.0.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/openemr/openemr/security/advisories/GHSA-778w-r8rm-8qhq x_refsource_CONFIRM
https://github.com/openemr/openemr/commit/fc4d00ecb63561dacd23cb1fed49c64bd1a83258 x_refsource_MISC