CVE-2026-25135: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-25135 is an information disclosure vulnerability in OpenEMR, a free and open-source electronic health records (EHR) and medical practice management application. Versions prior to 8.0.0 are affected, with the vulnerability present since 2023. The flaw allows any client holding system/(Group,Patient,*).$export and system/Location.read capabilities to retrieve complete contact information for all users, organizations, and patients in the system. It was disclosed on February 25, 2026, with a patch released in version 8.0.0. The CVSS v3.1 base score is 4.5 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The vulnerability exists in the FHIR FhirLocationService component, where the Group.$export operation's handling of the Location resource used an OR clause on the last-modified date filter that effectively bypassed patient-scoped filtering, returning all location records in the system rather than only those relevant to the authorized group (GitHub Advisory, Patch Commit). Exploitation requires network access and a pre-authorized confidential client with system/Location.read and system/(Group,Patient,*).$export scopes — permissions that must be explicitly granted by an administrator via secure key exchange. The fix refactored searchForOpenEMRRecords() in FhirLocationService.php to correctly scope location queries to patient UUIDs and facility types, eliminating the leaking OR clause (Patch Commit).

Successful exploitation results in the exfiltration of complete contact information — including addresses, phone numbers, and other personally identifiable information — for all users, organizations, and patients stored in the OpenEMR system. Given that OpenEMR is used in healthcare settings, this exposure constitutes a significant privacy breach potentially affecting protected health information (PHI) subject to HIPAA and similar regulations. There is no integrity or availability impact; the vulnerability is limited to confidentiality loss (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The EPSS score is approximately 0.028%, reflecting very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further constrained by the requirement for high privileges — specifically, an administrator must explicitly enable and grant the vulnerable scopes to a confidential client before exploitation is possible, limiting the attack surface to trusted server-to-server integration scenarios (GitHub Advisory).

1. Identify a target: Locate an OpenEMR instance prior to version 8.0.0 that has FHIR bulk export enabled and at least one confidential client authorized with system/(Group,Patient,*).$export and system/Location.read scopes.
2. Obtain client credentials: As an authorized server-to-server client (or by compromising one), obtain the confidential client credentials (client ID and private key) that have been granted the vulnerable scopes by an administrator.
3. Authenticate: Use the SMART on FHIR backend services authorization flow to obtain an access token with the system/Location.read and system/(Group,Patient,*).$export scopes.
4. Trigger the export: Issue a FHIR bulk export request targeting a Group resource (e.g., GET /fhir/Group/[id]/$export) using the obtained access token.
5. Retrieve Location data: Poll the export status endpoint and, once complete, download the resulting NDJSON export files. Due to the flawed OR clause in the location search, the Location resource file will contain contact information for all users, organizations, and patients in the system rather than only those in the requested group (GitHub Advisory, Patch Commit).

• Network: Unusual or unexpected FHIR bulk export requests to /fhir/Group/[id]/$export endpoints, particularly from server-to-server clients; large outbound data transfers following export job completion.
• Logs: OpenEMR access logs showing $export operations on Group resources followed by polling of export status endpoints and download of Location NDJSON files; access token requests for system/Location.read scope from unfamiliar client IDs.
• Application: Export jobs in the OpenEMR FHIR export queue initiated by clients not recognized as legitimate integration partners; Location export files significantly larger than expected (containing all patient/user records rather than a subset).

Upgrade to OpenEMR version 8.0.0 or later, which contains the patch addressing the flawed location search logic in FhirLocationService.php (GitHub Advisory, Patch Commit). As an immediate workaround prior to patching, disable all clients that have been granted the system/Location.read scope and restrict access to only clients that do not possess this scope. Additionally, audit all clients currently authorized with system/(Group,Patient,*).$export capabilities to ensure only legitimate, legally-bound trusted applications retain these permissions.

The advisory was published by OpenEMR maintainer bradymiller on GitHub on February 25, 2026, crediting adunsulag as the remediation developer. Red Hat tracked the vulnerability in their CVE database. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified (GitHub Advisory, Red Hat CVE).