CVE-2026-24896

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a Broken Access Control vulnerability exists in OpenEMR’s edih_main.php endpoint, which allows any authenticated user—including low-privilege roles like Receptionist—to access EDI log files by manipulating the log_select parameter in a GET request. The back-end fails to enforce role-based access control (RBAC), allowing sensitive system logs to be accessed outside the GUI-enforced permission boundaries. Version 8.0.0 fixes the issue.

• CWE-284

• https://github.com/openemr/openemr/commit/1a57dfc244b30e96e7ebdb5ba6f331a6eb868df1Patch
• https://github.com/openemr/openemr/security/advisories/GHSA-rccq-vjfg-ggjhExploit, Vendor Advisory

Published

Feb 25, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24890OpenEMR is a free and open source electronic health records …6.5
• CVE-2026-24891openITCOCKPIT is an open source monitoring tool built for di…7.5
• CVE-2026-24892openITCOCKPIT is an open source monitoring tool built for di…8.8
• CVE-2026-24893openITCOCKPIT is an open source monitoring tool built for di…8.8
• CVE-2026-24894FrankenPHP is a modern application server for PHP. Prior to …7.5
• CVE-2026-24895FrankenPHP is a modern application server for PHP. Prior to …9.8
• CVE-2026-24897Erugo is a self-hosted file-sharing platform. In versions up…8.8
• CVE-2026-24898OpenEMR is a free and open source electronic health records …9.8
• CVE-2026-24899Fleet is open source device management software. Prior to ve…7.5
• CVE-2026-2490RustDesk Client for Windows Transfer File Link Following Inf…5.5
• CVE-2026-24900MarkUs is a web application for the submission and grading o…6.5
• CVE-2026-24901Outline is a service that allows for collaborative documenta…8.8