CVE-2026-33304: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-33304 is an authorization bypass vulnerability in OpenEMR's dated reminders log that allows any authenticated non-admin user to view reminder messages belonging to other users, including associated patient names and free-text message content. It affects all OpenEMR versions prior to 8.0.0.2 and was disclosed on March 19, 2026. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory).

The root cause is a flawed server-side authorization guard in interface/main/dated_reminders/dated_reminders_log.php (CWE-639: Authorization Bypass Through User-Controlled Key; CWE-862: Missing Authorization). The guard was designed to restrict non-admin users to their own reminders, but it only activated when both the sentBy[] and sentTo[] GET parameters were absent — if a user explicitly supplied either parameter, the AND condition evaluated to false and no restriction was applied. The downstream function logRemindersArray() in library/dated_reminder_functions.php then consumed these user-supplied parameters directly to build SQL WHERE clauses with no further authorization check, and patient names were resolved via a separate per-row query against patient_data — also unchecked. The UI dropdown limiting non-admin users to "Myself" was a purely client-side control providing no security (GitHub Advisory, Patch Commit).

Successful exploitation exposes Protected Health Information (PHI) in a healthcare context, including patient names from the patient_data table and free-text reminder message content belonging to any user in the system. An attacker can enumerate reminders across all users by iterating over sequential integer user IDs. The exposure is read-only — no modification of reminders is possible through this vector — but the confidentiality impact is rated High given the sensitivity of the data involved (GitHub Advisory).

A proof-of-concept exploit with step-by-step instructions is publicly available in the GitHub Security Advisory, demonstrating exploitation via a simple crafted GET request requiring only a valid CSRF token and a low-privileged authenticated session. The EPSS score is approximately 0.028% (0.000280), indicating low predicted exploitation probability in the near term. There is no evidence of in-the-wild exploitation or CISA KEV catalog listing at this time (GitHub Advisory).

1. Obtain credentials: Log in to the target OpenEMR instance as any authenticated non-admin user (e.g., a staff member with access to the messages/reminders tab).
2. Retrieve CSRF token: Navigate to the dated reminders section and click "View Log" to load dated_reminders_log.php. Inspect the page source to extract the csrf_token_form value.
3. Craft malicious GET request: Using a browser address bar, developer tools, or a tool like curl, issue a request such as:

   GET /interface/main/dated_reminders/dated_reminders_log.php?csrf_token_form=<token>&sentTo[]=5

   Replace 5 with any target user's ID.
4. Enumerate user IDs: Since user IDs are sequential integers, iterate through values (e.g., 1, 2, 3, ...) to retrieve reminders across all users in the system.
5. Extract PHI: The response returns a table containing all reminders sent to or by the specified user, including patient names and free-text message bodies. Using sentBy[]=<id> similarly exposes all reminders authored by that user across all recipients (GitHub Advisory).

• Network: Repeated GET requests to /interface/main/dated_reminders/dated_reminders_log.php with sentTo[] or sentBy[] parameters containing user IDs other than the authenticated user's own ID; sequential enumeration of integer user ID values in these parameters.
• Logs: Web server access logs showing the above URL pattern from a single authenticated session across multiple different user ID values in rapid succession; HTTP 200 responses to these requests from non-admin accounts.
• Application Behavior: Non-admin user sessions accessing reminder data for users other than themselves, which would not occur under normal UI usage since the dropdown restricts selection to "Myself" (GitHub Advisory).

Upgrade OpenEMR to version 8.0.0.2 or later, which fixes the issue by unconditionally overriding the sentBy[] and sentTo[] parameters to the current authenticated user's ID for all non-admin users, regardless of user input. The patch is available at commit 21dee7658a5f3b18c5750e3fae7324e875c1703a. As an interim measure prior to patching, restrict network access to the OpenEMR instance to trusted personnel only, and review web server access logs for signs of unauthorized enumeration of the dated reminders log endpoint (Patch Commit, GitHub Advisory).

The vulnerability was reported by researchers pavelkohout396, stanislavfortaisle, and simecek, and was remediated by OpenEMR maintainer kojiromike. Aisle published a blog post noting this CVE as part of a broader discovery of 38 security vulnerabilities in healthcare software used by 100,000 providers, highlighting the systemic security risks in widely deployed EHR platforms (Aisle Blog).