CVE-2026-25164

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the REST API route table in `apis/routes/_rest_routes_standard.inc.php` does not call `RestConfig::request_authorization_check()` for the document and insurance routes. Other patient routes in the same file (e.g. encounters, patients/med) call it with the appropriate ACL. As a result, any valid API bearer token can access or modify every patient's documents and insurance data, regardless of the token’s OpenEMR ACLs—effectively exposing all document and insurance PHI to any authenticated API client. Version 8.0.0 patches the issue.

• CWE-862

• https://github.com/openemr/openemr/commit/c5e1c44774156cd0d04f4e08ed6a81fe76d38e92Patch
• https://github.com/openemr/openemr/security/advisories/GHSA-f64c-h2gh-g3f9Exploit, Vendor Advisory
• https://github.com/openemr/openemr/security/advisories/GHSA-f64c-h2gh-g3f9Exploit, Vendor Advisory

Published

Feb 25, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25155Qwik is a performance focused javascript framework. Prior to…7.1
• CVE-2026-25156HotCRP is conference review software. HotCRP versions from O…6.3
• CVE-2026-25157OpenClaw is a personal AI assistant. Prior to version 2026.1…7.5
• CVE-2026-2516A vulnerability was identified in Unidocs ezPDF DRM Reader a…7
• CVE-2026-25160Alist is a file list program that supports multiple storages…7.4
• CVE-2026-25161Alist is a file list program that supports multiple storages…8.8
• CVE-2026-25165Null pointer dereference in Windows Performance Counters all…7.8
• CVE-2026-25166Deserialization of untrusted data in Windows System Image Ma…7.8
• CVE-2026-25167Use after free in Microsoft Brokering File System allows an …7.4
• CVE-2026-25168Null pointer dereference in Microsoft Graphics Component all…5.5
• CVE-2026-25169Divide by zero in Microsoft Graphics Component allows an una…5.5
• CVE-2026-2517A security flaw has been discovered in Open5GS up to 2.7.6. …7.5