CVE-2026-25127

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the server does not properly validate user permission. Unauthorized users can view the information of authorized users. Version 8.0.0 fixes the issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Feb 25, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-251287.5fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callb CVE-2026-251297.3PsySH is a runtime developer console, interactive debugger, and REPL for PHP. Prior to versions 0.11.23 and 0.12.19, PsySH automatically loa CVE-2026-25136.1A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, whereby an administrator who clicks a malicious link pro CVE-2026-251309.6Cybersecurity AI (CAI) is a framework for AI Security. In versions up to and including 0.5.10, the CAI (Cybersecurity AI) framework contains CVE-2026-251318.8OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a Broken Ac CVE-2026-251334.8October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a stored cross-site scripting (XS CVE-2026-251348.8Group-Office is an enterprise customer relationship management and groupware tool. Prior to 6.8.150, 25.0.82, and 26.0.5, the MaintenanceCon CVE-2026-251354.5OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0 have an inf CVE-2026-251366.1Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizabl CVE-2026-251379.1The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odoo setup publicly exp CVE-2026-251385.3Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizabl CVE-2026-251399.1RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other em