{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24896", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-27T19:35:20.529Z", "datePublished": "2026-02-25T01:47:59.765Z", "dateUpdated": "2026-02-25T20:58:20.711Z"}, "containers": {"cna": {"title": "OpenEMR has Broken Access Control that allows unauthorized access to EDI Logs", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/openemr/openemr/security/advisories/GHSA-rccq-vjfg-ggjh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/openemr/openemr/security/advisories/GHSA-rccq-vjfg-ggjh"}, {"name": "https://github.com/openemr/openemr/commit/1a57dfc244b30e96e7ebdb5ba6f331a6eb868df1", "tags": ["x_refsource_MISC"], "url": "https://github.com/openemr/openemr/commit/1a57dfc244b30e96e7ebdb5ba6f331a6eb868df1"}], "affected": [{"vendor": "openemr", "product": "openemr", "versions": [{"version": "< 8.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T01:47:59.765Z"}, "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a Broken Access Control vulnerability exists in OpenEMR\u2019s edih_main.php endpoint, which allows any authenticated user\u2014including low-privilege roles like Receptionist\u2014to access EDI log files by manipulating the log_select parameter in a GET request. The back-end fails to enforce role-based access control (RBAC), allowing sensitive system logs to be accessed outside the GUI-enforced permission boundaries. Version 8.0.0 fixes the issue."}], "source": {"advisory": "GHSA-rccq-vjfg-ggjh", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T20:54:32.821863Z", "id": "CVE-2026-24896", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T20:58:20.711Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24896", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-25T20:54:32.821863Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T20:58:13.049Z"}}], "cna": {"title": "OpenEMR has Broken Access Control that allows unauthorized access to EDI Logs", "source": {"advisory": "GHSA-rccq-vjfg-ggjh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "openemr", "product": "openemr", "versions": [{"status": "affected", "version": "< 8.0.0"}]}], "references": [{"url": "https://github.com/openemr/openemr/security/advisories/GHSA-rccq-vjfg-ggjh", "name": "https://github.com/openemr/openemr/security/advisories/GHSA-rccq-vjfg-ggjh", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/openemr/openemr/commit/1a57dfc244b30e96e7ebdb5ba6f331a6eb868df1", "name": "https://github.com/openemr/openemr/commit/1a57dfc244b30e96e7ebdb5ba6f331a6eb868df1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a Broken Access Control vulnerability exists in OpenEMR\u2019s edih_main.php endpoint, which allows any authenticated user\u2014including low-privilege roles like Receptionist\u2014to access EDI log files by manipulating the log_select parameter in a GET request. The back-end fails to enforce role-based access control (RBAC), allowing sensitive system logs to be accessed outside the GUI-enforced permission boundaries. Version 8.0.0 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T01:47:59.765Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24896", "state": "PUBLISHED", "dateUpdated": "2026-02-25T20:58:20.711Z", "dateReserved": "2026-01-27T19:35:20.529Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-25T01:47:59.765Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*", "matchCriteriaId": "FEAA9896-A42E-437C-BEE8-8DA955E34385", "versionEndExcluding": "8.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a Broken Access Control vulnerability exists in OpenEMR\u2019s edih_main.php endpoint, which allows any authenticated user\u2014including low-privilege roles like Receptionist\u2014to access EDI log files by manipulating the log_select parameter in a GET request. The back-end fails to enforce role-based access control (RBAC), allowing sensitive system logs to be accessed outside the GUI-enforced permission boundaries. Version 8.0.0 fixes the issue."}], "id": "CVE-2026-24896", "lastModified": "2026-02-25T16:54:24.783", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-02-25T02:16:22.353", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/openemr/openemr/commit/1a57dfc244b30e96e7ebdb5ba6f331a6eb868df1"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/openemr/openemr/security/advisories/GHSA-rccq-vjfg-ggjh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.0.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "openemr", "source": "cna", "vendor": "openemr"}, "product": "openemr", "vendor": "openemr"}], "analysis": {"en": {"generated_at": "2026-04-17T15:33:58.716157+00:00", "value": {"mitigation_remediation": ["Upgrade OpenEMR to version 8.0.0 or later to apply the vendor patch that enforces proper role\u2011based access control on the edih_main.php endpoint.", "After upgrading, validate that only users with administrative privileges can invoke the log_select functionality by performing test requests or reviewing access logs.", "If an immediate upgrade is not possible, restrict the edih_main.php endpoint to administrators only at the web\u2011server level (e.g., using .htaccess or equivalent configuration rules) to prevent unauthorized log access until the patch can be applied."], "summary": {"action": "Patch Upgrade", "impact": "Unauthorized Access to Sensitive EDI Log Files"}, "threat_synthesis": {"affected_systems": "Older OpenEMR releases prior to version 8.0.0 are susceptible. Users running the openemr:openemr product with versions earlier than 8.0.0 are at risk; the update to 8.0.0 resolves the flaw.", "description_and_impact": "A flaw in OpenEMR\u2019s edih_main.php endpoint allows any authenticated user\u2014including low\u2011privilege roles such as Receptionist\u2014to retrieve EDI log files by tampering with the log_select GET parameter. The back\u2011end neglects role\u2011based access control, permitting read access to logs that are normally protected within the GUI. The vulnerability is a classic Broken Access Control issue, identified as CWE\u2011284.", "risk_and_exploitability": "The CVSS score of 6.5 classifies this as a medium\u2011severity vulnerability, and the EPSS score of less than 1% indicates a low likelihood of exploitation at the time of analysis. The flaw does not appear in the CISA KEV list, yet it requires authentication and is therefore likely to be leveraged by internal users or an attacker who has compromised legitimate credentials. Exploitation is straightforward: an attacker logs in, performs a GET request to edih_main.php with a manipulated log_select value, and obtains the log file. No additional privileges or conditions are required beyond authenticated access."}}}}, "created": "2026-02-25T11:35:12.401506+00:00", "updated": "2026-04-17T15:45:15.889504+00:00", "vendors": ["openemr", "openemr$PRODUCT$openemr"]}