CVE-2026-25124: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-25124 is a Broken Access Control (Missing Authorization) vulnerability in OpenEMR's message list CSV export functionality that allows low-privileged authenticated users to export the entire message list containing sensitive patient and user data. It affects all OpenEMR versions prior to 8.0.0 and was disclosed on February 25, 2026. The vulnerability was reported by security researcher heshamm1 and patched in OpenEMR version 8.0.0. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Feedly).

The vulnerability is classified as CWE-862 (Missing Authorization) and resides in interface/reports/message_list.php. When a POST request is submitted with the form_csvexport=true parameter, the script executes sensitive database queries joining the pnotes, patient_data, and users tables — retrieving patient names, dates of birth, message bodies, and user metadata — without performing any role-based access control check (e.g., acl_check() or AclMain::aclCheckCore()). The only security control in place is CSRF token verification, which does not prevent unauthorized data access if a valid token is obtained through normal application use. The fix, applied in commit ad902d6, adds an AclMain::aclCheckCore('patients', 'med') check at the top of the script, blocking unauthorized users before any data processing occurs (GitHub Advisory, Patch Commit).

Successful exploitation allows any low-privileged OpenEMR user (e.g., a receptionist) to export a CSV file containing the complete message list across all patients and users, including protected health information (PHI) such as patient names, dates of birth, public patient IDs, message bodies, message statuses, and associated usernames. The confidentiality impact is high, as this constitutes unauthorized disclosure of sensitive healthcare data that may trigger HIPAA breach notification obligations. There is no integrity or availability impact, and no lateral movement capability is directly enabled by this vulnerability (GitHub Advisory, Feedly).

A proof-of-concept (PoC) is publicly available in the GitHub Security Advisory, demonstrating exploitation via a crafted POST request using a proxy tool such as Burp Suite. No evidence of in-the-wild exploitation has been observed as of the time of disclosure. The EPSS score is approximately 0.028% (0.000280), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid low-privileged account and a legitimate CSRF token, both of which are readily obtainable by any authenticated user (GitHub Advisory, Feedly).

1. Authenticate: Log in to the OpenEMR application as any low-privileged user (e.g., a receptionist account).
2. Obtain CSRF token: Navigate to interface/reports/message_list.php in a browser and capture the csrf_token_form value from the page source or intercept a legitimate request using a proxy tool such as Burp Suite.
3. Craft malicious POST request: Construct a POST request to /openemr/interface/reports/message_list.php with the following body parameters: csrf_token_form=<captured_token>&form_refresh=&form_csvexport=true&form_from_date=2000-01-01&form_to_date=2026-12-31.
4. Submit the request: Send the crafted request using Burp Suite Repeater or a similar tool, ensuring the session cookie from the authenticated low-privileged session is included.
5. Receive exported data: The server responds with a message_list.csv file download containing sensitive patient and user data across all records in the specified date range, including names, dates of birth, message bodies, and user metadata (GitHub Advisory).

• Network: Unexpected POST requests to /openemr/interface/reports/message_list.php with form_csvexport=true from user accounts that do not have administrative or clinical roles; responses with Content-Disposition: attachment; filename=message_list.csv headers.
• Logs: Web server access logs showing POST requests to message_list.php from low-privileged user sessions, particularly with date ranges spanning large time periods; repeated or automated requests to this endpoint outside of normal business hours.
• File System: Presence of message_list.csv files in unexpected locations on endpoints used by low-privileged staff, potentially indicating downloaded exports.
• Application Logs: OpenEMR audit logs showing CSV export activity by user accounts without the patients/med ACL permission (relevant for patched versions where such access would be blocked and logged) (GitHub Advisory).

Upgrade OpenEMR to version 8.0.0 or later, which introduces a proper AclMain::aclCheckCore('patients', 'med') permission check in message_list.php before any data processing occurs (Patch Commit). For organizations unable to immediately upgrade, consider restricting network-level access to the interface/reports/message_list.php endpoint for non-clinical user roles via web server configuration (e.g., Apache/Nginx access controls). Additionally, audit existing user permissions and review access logs for any unauthorized export activity by low-privileged accounts (GitHub Advisory).