CVE-2026-25147: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-25147 is an Insecure Direct Object Reference (IDOR) / authorization bypass vulnerability in OpenEMR's patient portal payment module (portal/portal_payment.php). It affects all OpenEMR versions prior to 8.0.0 and allows authenticated portal users to access other patients' demographics, invoices, and payment history through horizontal privilege escalation. The vulnerability was published on February 27, 2026, with a fix released in version 8.0.0. It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-862 (Missing Authorization). In portal/portal_payment.php, the patient ID ($pid) is overwritten with attacker-supplied values from request parameters ($_REQUEST['pid'] and $_REQUEST['hidden_patient_code']) before any authorization check, rather than being anchored to the session-authenticated user's ID. The fix (commit d6ab3cd) wraps the $pid assignment in a conditional block (if (!$isPortal)) so that in portal context, the session-derived $pid is always used, and similarly enforces $form_pid = $isPortal ? $pid : $_POST['form_pid'] for form submissions and receipt lookups. A public proof-of-concept is included in the GitHub security advisory (GitHub Advisory, GitHub Commit).

Successful exploitation allows any authenticated portal patient to view and interact with another patient's protected health information (PHI), including demographics, invoices, and payment history — a significant breach of patient privacy. The attack enables horizontal privilege escalation without any privilege upgrade, meaning a low-privileged portal user can access records for any patient whose pid can be guessed or enumerated. There is no availability impact, but confidentiality impact is rated High and integrity impact is rated Low, as an attacker could potentially manipulate payment-related interactions for other patients. All OpenEMR deployments with the patient portal enabled are affected (GitHub Advisory).

A proof-of-concept exploit is publicly documented in the GitHub security advisory, demonstrating exploitation via a simple GET request or form submission with a manipulated pid parameter. No evidence of in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is 0.028% (0.000280), indicating low predicted exploitation probability in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been made (GitHub Advisory).

1. Obtain valid portal credentials: Register or obtain login credentials for the OpenEMR patient portal on a target instance running a version prior to 8.0.0.
2. Authenticate to the portal: Log in as a legitimate patient (e.g., with pid=25). Note the session cookie issued upon successful authentication.
3. Identify target patient IDs: Patient IDs (pid) are typically sequential integers. An attacker can enumerate them by incrementing or decrementing from their own known pid.
4. Send crafted request: In the same authenticated session, navigate to https://target-openemr.com/portal/portal_payment.php?pid=17 (substituting the target patient's pid), or submit a POST form to portal_payment.php with hidden_patient_code=17.
5. Access victim's PHI: The server loads and displays demographics, invoices, and payment history for the target patient (pid=17) without verifying that the authenticated user is authorized to access that record (GitHub Advisory).

• Network: HTTP GET or POST requests to /portal/portal_payment.php where the pid or hidden_patient_code parameter value differs from the authenticated session's patient ID; repeated requests to the same endpoint with incrementing/decrementing pid values (enumeration pattern).
• Logs: Web server access logs showing the same session cookie accessing portal_payment.php with multiple distinct pid values in a short time window; application logs recording patient data lookups for patients other than the session owner.
• Application Behavior: Portal audit logs (if enabled) showing a single portal user account accessing billing/payment records for multiple different patient IDs (GitHub Advisory).

Upgrade OpenEMR to version 8.0.0 or later, which contains the fix that anchors $pid to the session-authenticated user in portal context, preventing user-supplied values from overriding it. No official configuration-based workaround has been published; the most effective interim measure for organizations unable to immediately upgrade is to disable the patient portal payment page or restrict network access to the portal. Administrators should also review access logs for signs of unauthorized cross-patient data access (GitHub Advisory, GitHub Commit).

The vulnerability was credited to researchers simecek (reporter), stanislavfortaisle, and pavelkohout396 (analysts) in the GitHub security advisory. A blog post from Aisle noted the discovery of 38 critical security vulnerabilities in healthcare software used by 100,000 providers, which appears to include this finding (Aisle Blog). The advisory was also noted on Bluesky and tracked by multiple vulnerability aggregators shortly after disclosure (GitHub Advisory).