CVE-2026-25135

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0 have an information disclosure vulnerability that leaks the entire contact information for all users, organizations, and patients in the system to anyone who has the system/(Group,Patient,*).$export operation and system/Location.read capabilities. This vulnerability will impact OpenEMR versions since 2023. This disclosure will only occur in extremely high trust environments as it requires using a confidential client with secure key exchange that requires an administrator to enable and grant permission before the app can even be used. This will typically only occur in server-server communication across trusted clients that already have established legal agreements. Version 8.0.0 contains a patch. As a workaround, disable clients that have the vulnerable scopes and only allow clients that do not have the system/Location.read scope until a fix has been deployed.

• CWE-200

• https://github.com/openemr/openemr/commit/7ab23dfe73ebd16dd66a526272f3761f1bd5be7dPatch
• https://github.com/openemr/openemr/security/advisories/GHSA-fgxg-wg4w-rj23Vendor Advisory

Published

Feb 25, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25129PsySH is a runtime developer console, interactive debugger, …7.3
• CVE-2026-2513A vulnerability exists in Progress Flowmon ADS versions prio…8.6
• CVE-2026-25130Cybersecurity AI (CAI) is a framework for AI Security. In ve…9.6
• CVE-2026-25131OpenEMR is a free and open source electronic health records …8.8
• CVE-2026-25133October is a Content Management System (CMS) and web platfor…4.8
• CVE-2026-25134Group-Office is an enterprise customer relationship manageme…8.8
• CVE-2026-25136Rucio is a software framework that provides functionality to…6.1
• CVE-2026-25137The NixOs Odoo package is an open source ERP and CRM system.…9.1
• CVE-2026-25138Rucio is a software framework that provides functionality to…5.3
• CVE-2026-25139RIOT is an open-source microcontroller operating system, des…9.1
• CVE-2026-2514In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3,…8.6
• CVE-2026-25140apko allows users to build and publish OCI container images …7.5