CVE-2026-33918: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-33918 is a Missing Authorization vulnerability in OpenEMR's billing file-download endpoint (interface/billing/get_claim_file.php) that allows any authenticated user to download and permanently delete electronic claim batch files containing Protected Health Information (PHI). It affects all OpenEMR versions prior to 8.0.0.3 and was disclosed on March 25–26, 2026. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) per Feedly/NVD, or 7.6 (High) per the GitHub Security Advisory (GitHub Advisory, Red Hat CVE).

The root cause is CWE-862 (Missing Authorization): the interface/billing/get_claim_file.php endpoint performs only a CSRF token check and does not invoke AclMain::aclCheckCore(), unlike every other endpoint in the interface/billing/ directory which enforces acct/eob or acct/bill write permissions (GitHub Advisory). After passing the CSRF check, the endpoint reads a key parameter, locates the claim batch file across up to three directories (temp files, SFTP directory, or documents/edi), and streams it via fpassthru(); if $_GET['delete'] == 1, the file is permanently removed via unlink(). Claim batch filenames follow a predictable timestamp pattern (YYYY-MM-DD-HHmmss-batch.txt), making enumeration straightforward, though convert_safe_file_dir_name() prevents path traversal by restricting filenames to [A-Za-z0-9_.-] (GitHub Advisory). The fix adds AclMain::aclCheckCore('acct', 'eob', '', 'write') and AclMain::aclCheckCore('acct', 'bill', '', 'write') checks before the CSRF verification (GitHub Commit).

Any authenticated OpenEMR user — regardless of role or billing privileges — can exploit this vulnerability to exfiltrate X12 837-format claim batch files containing PHI (patient names, dates of birth, diagnoses, procedure codes, and insurance identifiers) and permanently delete those files from the server (GitHub Advisory). The confidentiality impact is high due to exposure of sensitive healthcare data subject to HIPAA protections, the integrity impact is high due to unauthorized deletion of billing records, and the availability impact is high due to potential loss of critical billing workflow data (Red Hat CVE). This vulnerability is particularly significant in healthcare environments where PHI exposure can trigger regulatory penalties and billing disruption can affect revenue cycles.

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (Red Hat CVE). The EPSS score is approximately 0.029% (0.000290), indicating a low current probability of exploitation in the wild (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the predictable filename pattern and low exploitation complexity (only a valid session and CSRF token required) make it relatively easy for any authenticated user to exploit without specialized tools.

1. Obtain authenticated access: Log in to the target OpenEMR instance with any valid user account — even a low-privileged account with no billing permissions.
2. Retrieve a valid CSRF token: Navigate to any OpenEMR billing page (e.g., billing_tracker.php) and extract the csrf_token_form value from the page source or network traffic.
3. Enumerate claim batch filenames: Guess or enumerate filenames following the predictable pattern YYYY-MM-DD-HHmmss-batch.txt (e.g., 2026-03-25-143000-batch.txt) based on known or estimated billing activity dates (GitHub Advisory).
4. Download PHI-containing files: Craft a direct HTTP GET request to interface/billing/get_claim_file.php?key=<filename>&csrf_token_form=<token> — the server will stream the X12 837 claim batch file containing PHI without checking billing ACL permissions.
5. Optionally delete files: Append &delete=1 to the request URL to permanently delete the file from the server via unlink(), disrupting billing workflows (GitHub Advisory).

• Network: Unexpected HTTP GET requests to interface/billing/get_claim_file.php from user accounts that do not have billing roles; repeated requests with incrementing timestamp-based filenames suggesting enumeration.
• Logs: Web server access logs showing requests to get_claim_file.php from non-billing user sessions; OpenEMR application logs recording file downloads or deletions by users without acct/eob or acct/bill privileges.
• File System: Missing or unexpectedly deleted files in documents/edi/ directory or the configured SFTP partner directory; gaps in claim batch file sequences (e.g., missing YYYY-MM-DD-HHmmss-batch.txt files).
• Application: Audit trail entries showing claim file access by users whose roles do not include billing manager permissions.

Upgrade OpenEMR to version 8.0.0.3 or later, which adds proper AclMain::aclCheckCore('acct', 'eob', '', 'write') and AclMain::aclCheckCore('acct', 'bill', '', 'write') checks to the get_claim_file.php endpoint (GitHub Release, GitHub Commit). As a temporary workaround prior to patching, restrict authenticated access to OpenEMR to only trusted users and implement network-level controls (e.g., VPN, IP allowlisting) to limit who can reach the application. Organizations should also review access logs for any unauthorized access to the billing endpoint and assess whether PHI exposure has occurred.

The vulnerability was part of a broader batch of 18+ security fixes released in OpenEMR 8.0.0.3, including multiple SQL injection, XSS, and IDOR issues, highlighting systemic authorization gaps in the platform (GitHub Release). Security firm Aisle published a blog post noting the discovery of 38 critical security vulnerabilities in healthcare software used by 100,000 providers, which appears to include this CVE (Aisle Blog). The vulnerability was credited to researchers pavelkohout396, simecek, and kojiromike via the GitHub Security Advisory (GitHub Advisory).