CVE-2026-25930: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-25930 is an authorization bypass (IDOR) vulnerability in OpenEMR's Layout-Based Form (LBF) printable view that allows authenticated users to access any patient's encounter forms without authorization. Affecting all OpenEMR versions prior to 8.0.0, the flaw was disclosed on February 25, 2026, and patched in version 8.0.0. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Red Hat).

The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) and resides in interface/forms/LBF/printable.php. The script accepts formid, visitid, and patientid directly from user-supplied request parameters ($_REQUEST) without verifying that the requested form belongs to the session-authenticated patient or encounter. An attacker can supply arbitrary formid and visitid values — obtained through enumeration, sequential guessing, or cross-session observation — to retrieve Protected Health Information (PHI) for any patient in the system. The fix, applied in commit 8c76acd, replaces request-parameter trust with session-bound values ($pid, $encounter) and adds a database ownership check before rendering any form (GitHub Advisory, GitHub Commit).

Successful exploitation exposes confidential patient Protected Health Information (PHI) — including encounter forms, medical history, and clinical data — to any authenticated user with LBF access. The impact is limited to confidentiality (no integrity or availability impact), but the breadth is significant: all patient records stored in LBF forms across the entire deployment are potentially accessible. This constitutes a serious HIPAA/privacy violation risk for healthcare organizations and could affect all deployments using the LBF module (GitHub Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, demonstrating the attack via a simple crafted GET request. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.028% (0.000280), indicating low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Authenticate: Log in to the target OpenEMR instance as any user with LBF (Layout-Based Form) access, such as a clinician or administrative user.
2. Identify a valid form reference: Obtain at least one known formid and visitid from a legitimately accessible patient record, or note that IDs are often sequential integers.
3. Enumerate target form IDs: Increment or vary the formid and visitid parameters to identify forms belonging to other patients (e.g., formid=1001, visitid=5002, patientid=123).
4. Request the printable view: Send a crafted GET request to the vulnerable endpoint:

   GET /interface/forms/LBF/printable.php?formname=YourFormName&formid=1001&visitid=5002&patientid=123 HTTP/1.1
   Host: target-openemr.com
   Cookie: <valid session cookie>

5. Retrieve PHI: If the server returns the form content or PDF for the targeted patient, the IDOR is confirmed and the attacker can view or print that patient's encounter data.
6. Repeat: Iterate over additional formid/visitid combinations to systematically harvest PHI across multiple patients (GitHub Advisory).

• Network: Repeated GET requests to /interface/forms/LBF/printable.php with varying formid, visitid, or patientid parameters from a single authenticated session; requests referencing patient IDs inconsistent with the user's assigned patient panel.
• Logs: OpenEMR access logs showing sequential or rapidly varying formid/visitid values in requests to printable.php; after patching, system logs will contain warning entries: "An attempt was made to view an LBF form belonging to a different patient or encounter" along with the requesting user ID and form ID.
• Audit Trail: OpenEMR event audit log entries with event type security-access and message "Unauthorized attempt to view LBF form <id> for pid <pid>" (generated by the patched version's EventAuditLogger) (GitHub Commit).

Upgrade OpenEMR to version 8.0.0 or later, which implements proper session-bound authorization checks in interface/forms/LBF/printable.php (GitHub Commit). Until patching is feasible, restrict access to the LBF printable view endpoint at the network or web server level to only trusted internal users, and limit LBF access permissions to the minimum necessary user roles. Monitor web server and OpenEMR access logs for suspicious enumeration patterns targeting printable.php with varying patient or form identifiers (GitHub Advisory).

The vulnerability was reported by researchers simecek (reporter) and pavelkohout396 (analyst), with remediation developed by kojiromike and committed by OpenEMR maintainer bradymiller. Red Hat tracked the CVE through their security advisory system. A blog post from Aisle noted the discovery of 38 security vulnerabilities in healthcare software used by 100,000 providers, which may include this finding (GitHub Advisory, Red Hat).