CVE-2025-46823
Last modified
CVE-2025-46823 is a high-severity vulnerability rated 8/10 on the CVSS scale. openmrs-module-fhir2 provides the FHIR REST API and related services for OpenMRS, an open medical records system. In versions of the FHIR2 module prior to 2.5.0, privileges were not always correctly checked, which means that unauthorized users may have been able to add or edit data they were not supposed to be able to. EPSS estimates a 0.32% chance of exploitation in the next 30 days.
Description
openmrs-module-fhir2 provides the FHIR REST API and related services for OpenMRS, an open medical records system. In versions of the FHIR2 module prior to 2.5.0, privileges were not always correctly checked, which means that unauthorized users may have been able to add or edit data they were not supposed to be able to. All implementers should update to FHIR2 2.5.0 or newer as soon as is feasible to receive a patch.
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-46823?
How severe is CVE-2025-46823?
How do I fix CVE-2025-46823?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-46818Redis is an open source, in-memory database that persists on…7.3
- CVE-2025-46819Redis is an open source, in-memory database that persists on…7.1
- CVE-2025-4682The Essential Blocks – Page Builder Gutenberg Blocks, Patter…6.4
- CVE-2025-46820phpgt/Dom provides access to modern DOM APIs. Versions of ph…7.1
- CVE-2025-46821Envoy is a cloud-native edge/middle/service proxy. Prior to …5.3
- CVE-2025-46822OsamaTaher/Java-springboot-codebase is a collection of Java …7.7
- CVE-2025-46824The Discourse Code Review Plugin allows users to review GitH…3.1
- CVE-2025-46825Kanboard is project management software that focuses on the …5.4
- CVE-2025-46826insa-auth is an authentication server for INSA Rouen. A mino…1.3
- CVE-2025-46827Graylog is a free and open log management platform. Prior to…5.4
- CVE-2025-46828WeGIA is a web manager for charitable institutions. An unau…9.8
- CVE-2025-4683The MStore API – Create Native Android & iOS Apps On The Clo…4.3
Are you affected by CVE-2025-46823?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST