CVE-2026-25131: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-25131 is a Broken Access Control vulnerability in OpenEMR's order types management system that allows low-privilege authenticated users (such as those with a Receptionist role) to add, modify, and delete procedure types without proper authorization. The vulnerability affects all OpenEMR versions prior to 8.0.0 and is present in the /openemr/interface/orders/types_edit.php and types_ajax.php endpoints. It was disclosed on February 25, 2026, with a patch released in version 8.0.0. The CVSS v3.1 base score is 8.8 (High) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization). The vulnerable endpoints types_edit.php and types_ajax.php perform no access control checks before processing form submissions or returning data, meaning any authenticated user can directly access these endpoints and bypass the ACL checks enforced only in the parent types.php page. Additionally, the form submission lacked CSRF protection, compounding the risk. The fix, applied in commit 1e63cba, adds AclMain::aclCheckCore('admin', 'super') checks to types_edit.php and either admin/super or patients/lab checks to types_ajax.php, along with CSRF token validation (GitHub Advisory, Patch Commit).

Successful exploitation allows any authenticated low-privilege user to view all existing procedure types, add new procedure types, modify existing ones, and delete them — effectively gaining full control over the order types configuration. This can disrupt the integrity of the medical ordering system, corrupt patient treatment documentation, and potentially introduce malicious procedure types that affect patient care workflows. The vulnerability carries high confidentiality, integrity, and availability impacts given the sensitive nature of electronic health record data (GitHub Advisory).

A proof-of-concept is publicly documented in the GitHub Security Advisory, including specific HTTP request payloads for adding, editing, and deleting procedure types. There is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.039% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only a valid low-privilege authenticated session, making it accessible to any internal user or compromised account (GitHub Advisory).

1. Obtain low-privilege credentials: Log in to OpenEMR with any low-privilege account (e.g., Receptionist role). No administrative access is required.
2. Enumerate existing procedure types: Send a GET request to https://<target>/openemr/interface/orders/types_ajax.php?id=0&order=0&labid=0&_=<timestamp> to retrieve all existing procedure types without authorization checks.
3. Add a new procedure type: Send a crafted POST request directly to /openemr/interface/orders/types_edit.php?typeid=0&parent=0 with form parameters such as form_procedure_type=grp&form_name=BAC-TEST&form_description=BAC-TEST&form_save=Save. The server processes the request without verifying the user's role.
4. Modify an existing procedure type: Repeat the POST request with a known typeid value (obtained from step 2) to overwrite an existing procedure type's attributes.
5. Delete a procedure type: Send the same POST request but set form_save=Delete along with the target typeid to remove the procedure type from the system.
6. Verify changes: Confirm the unauthorized modifications by re-querying the types_ajax.php endpoint or checking the admin interface (GitHub Advisory).

• Network: Unexpected POST requests to /openemr/interface/orders/types_edit.php originating from user accounts with low-privilege roles (e.g., Receptionist); GET requests to types_ajax.php from non-administrative accounts.
• Logs: OpenEMR access logs showing requests to types_edit.php or types_ajax.php from sessions associated with non-admin users; repeated access to these endpoints outside of normal administrative workflows.
• Application: Unexpected additions, modifications, or deletions of procedure types in the order management system not attributable to administrative actions; new procedure type entries with unusual names (e.g., test strings like BAC-TEST).
• Database: Unexpected INSERT or UPDATE statements in the procedure_type table from non-administrative database sessions (GitHub Advisory).

Upgrade OpenEMR to version 8.0.0 or later, which contains the patch adding proper ACL and CSRF checks to the affected endpoints. The fix is available in commit 1e63cbab34558bca029533f87cdb6efb1ff32c75. As an interim workaround prior to upgrading, administrators should restrict network access to the /openemr/interface/orders/ directory for non-administrative users at the web server level, and audit user role assignments to minimize the number of accounts with access to the OpenEMR instance (GitHub Advisory, Patch Commit).

The vulnerability was reported by security researcher heshamm1 and published by OpenEMR maintainer bradymiller via the GitHub Security Advisory program on February 25, 2026. The Hacker Wire covered the disclosure, and the advisory was referenced by INCIBE-CERT and Red Hat's CVE tracking system. Community reaction has been limited given the relatively narrow scope of the affected software (GitHub Advisory, Red Hat CVE).