Medium 6.5HealthcarePublished Feb 25, 2026

CVE-2026-25124OpenEMR has Broken Access Control in Report/Clients/Message List CSV Export

Updated under an hour ago (2026-10-19 09:40 UTC)

Does this affect you?

It affects openemr and 1 other product. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.28%, higher than 19% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for openemr

Exploited in the last 30 days

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the OpenEMR application is vulnerable to an access control flaw that allows low-privileged users, such as receptionists, to export the entire message list containing sensitive patient and user data. The vulnerability lies in the message_list.php report export functionality, where there is no permission check before executing sensitive database queries. The only control in place is CSRF token verification, which does not prevent unauthorized data access if the token is acquired through other means. Version 8.0.0 fixes the vulnerability.

CVSS: 6.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE): CWE-862
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.28% (percentile 19)
Assigned by: GitHub_M
NVD analysis: Analyzed
Record last updated: Feb 25, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

openemr openemr openemr:openemr (from the name)	before 8.0.0	CNA record
open-emr openemr open-emr:openemr	before 8.0.0	NVD

References

https://github.com/openemr/openemr/security/advisories/GHSA-q7p5-rrwj-qmp2x-refsource-confirm, exploit, mitigation, vendor-advisory
https://github.com/openemr/openemr/commit/ad902d6892482fff2e3c56bfb15597df8b6c3bebx-refsource-misc, patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.