CVE-2026-25930

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the Layout-Based Form (LBF) printable view accepts `formid` and `visitid` (or `patientid`) from the request and does not verify that the form belongs to the current user’s authorized patient/encounter. An authenticated user with LBF access can enumerate form IDs and view or print any patient’s encounter forms. Version 8.0.0 fixes the issue.

• CWE-639

• https://github.com/openemr/openemr/commit/8c76acdd226007cc4ff3eccd3ca6193e0be6e699Patch
• https://github.com/openemr/openemr/security/advisories/GHSA-h3xx-8cp7-hf7mExploit, Vendor Advisory

Published

Feb 25, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25925PowerDocu contains a Windows GUI executable to perform techn…7.8
• CVE-2026-25926Notepad++ is a free and open-source source code editor. An U…7.3
• CVE-2026-25927OpenEMR is a free and open source electronic health records …7.1
• CVE-2026-25928OpenEMR is a free and open source electronic health records …6.5
• CVE-2026-25929OpenEMR is a free and open source electronic health records …6.5
• CVE-2026-2593The Greenshift – animation and page builder blocks plugin fo…6.4
• CVE-2026-25931vscode-spell-checker is a basic spell checker that works wel…7.8
• CVE-2026-25932GLPI is a Free Asset and IT Management Software package. Fro…4.8
• CVE-2026-25933Arduino App Lab is a cross-platform IDE for developing Ardui…6.8
• CVE-2026-25934go-git is a highly extensible git implementation library wri…4.3
• CVE-2026-25935Vikunja is a todo-app to organize your life. Prior to 1.1.0,…5.4
• CVE-2026-25936GLPI is a free Asset and IT management software package. Sta…8.8