Skip to main content

Mondoo Vulnerability Intelligence

Curated by Mondoo Research, enhanced with AI

Resources

Search Vulnerabilities
Trending CVEs
Browse Ecosystems
Terminology
Blog

Open Source

cnquery
cnspec

Star us on GitHub!

Company

Mondoo Platform
About
Contact

© 2026 Mondoo, Inc.

Privacy Policy Terms of Service Imprint

Vulnerability Intelligence

Vulnerability IntelligenceCVE-2026-25127

CVE-2026-25127

HIGH7.0

OpenEMR has Broken Access Control on Care Coordination Module

Published Feb 25, 2026

Modified 1 weeks ago

Details

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the server does not properly validate user permission. Unauthorized users can view the information of authorized users. Version 8.0.0 fixes the issue.

References

https://github.com/openemr/openemr/commit/ad902d6892482fff2e3c56bfb15597df8b6c3beb

https://github.com/openemr/openemr/security/advisories/GHSA-69cv-rv28-4g85

https://www.cve.org/CVERecord?id=CVE-2026-25127

CVSS Analysis

CVSS v4.0

7.0

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Attack Requirements

PresentAT:P

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Vulnerable System

Vuln. Confidentiality

HighVC:H

Vuln. Integrity

NoneVI:N

Vuln. Availability

NoneVA:N

Subsequent System

Subseq. Confidentiality

HighSC:H

Subseq. Integrity

NoneSI:N

Subseq. Availability

NoneSA:N

7/CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Weakness Type (CWE)

Access Control

Incorrect Authorization

Ecosystems

Timeline

PublishedFeb 25, 2026

ModifiedFeb 25, 2026

CVE-2026-25127 | Mondoo Vulnerability Intelligence