CVE-2026-25929
OpenEMR is a free and open source electronic health records and medical practice management application.
Published Feb 25, 2026 · updated Jun 17, 2026 · open-emr openemr
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the document controller’s context serves the patient’s photo by document ID or patient ID without verifying that the current user is authorized to access that patient. An authenticated user with document ACL can supply another patient’s ID and retrieve their photo. Version 8.0.0 fixes the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Feb 25, 2026 · NIST NVD
Detected
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the document controller’s context serves the patient’s photo by document ID or patient ID without verifying that the current user is authorized to access that patient. An authenticated user with document ACL can supply another patient’s ID and retrieve their photo. Versi
Jun 17, 2026 · NIST NVD
Updated
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the document controller’s context serves the patient’s photo by document ID or patient ID without verifying that the current user is authorized to access that patient. An authenticated user with document ACL can supply another patient’s ID and retrieve their photo. Versi
Affected
- cpe open-emr/openemrversion unspecified
Sources
- NIST NVDVulnerability recordCVE-2026-25929
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the document controller’s context serves the patient’s photo by document ID or patient ID without verifying that the current user is
nvd.nist.gov