CVE-2026-25131

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a Broken Access Control vulnerability exists in the OpenEMR order types management system, allowing low-privilege users (such as Receptionist) to add and modify procedure types without proper authorization. This vulnerability is present in the /openemr/interface/orders/types_edit.php endpoint. Version 8.0.0 contains a patch.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
openemr	openemr	< 8.0.0

References

https://github.com/openemr/openemr/commit/1e63cbab34558bca029533f87cdb6efb1ff32c75Patch
https://github.com/openemr/openemr/security/advisories/GHSA-6h2m-4ppf-ph4jExploit, Mitigation, Vendor Advisory

Timeline

Published: Feb 25, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-251334.8October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a stored cross-site scripting (XS CVE-2026-251348.8Group-Office is an enterprise customer relationship management and groupware tool. Prior to 6.8.150, 25.0.82, and 26.0.5, the MaintenanceCon CVE-2026-251354.5OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0 have an inf CVE-2026-251366.1Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizabl CVE-2026-251379.1The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odoo setup publicly exp CVE-2026-251385.3Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizabl CVE-2026-251399.1RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other em CVE-2026-25146.1In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring p CVE-2026-251407.5apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who co CVE-2026-251419.8Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions starting with 7.19.0 and p CVE-2026-2514210.0SandboxJS is a JavaScript sandboxing library. Prior to 0.8.27, SanboxJS does not properly restrict __lookupGetter__ which can be used to obt CVE-2026-251437.8melange allows users to build apk packages using declarative pipelines. From version 0.10.0 to before 0.40.3, an attacker who can influence