CVE-2026-24890
Published: 25 February 2026
Description
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an authorization bypass vulnerability in the patient portal signature endpoint allows authenticated portal users to upload and overwrite provider signatures by…
more
setting `type=admin-signature` and specifying any provider user ID. This could potentially lead to signature forgery on medical documents, legal compliance violations, and fraud. The issue occurs when portal users are allowed to modify provider signatures without proper authorization checks. Version 8.0.0 fixes the issue.
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations, directly preventing authenticated patient portal users from bypassing checks to overwrite provider signatures.
Restricts patient portal users to least privilege, prohibiting access to admin-signature modification functions intended for providers only.
Remediates the specific authorization bypass flaw by applying the vendor fix in OpenEMR version 8.0.0 or later.
Security SummaryAI
CVE-2026-24890 is an authorization bypass vulnerability (CWE-285) in OpenEMR, a free and open-source electronic health records and medical practice management application. The issue affects versions prior to 8.0.0 and exists in the patient portal signature endpoint, where portal users can modify provider signatures without proper authorization checks. It carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating high confidentiality and integrity impacts from network-accessible exploitation with low privileges and complexity.
Authenticated patient portal users can exploit the vulnerability by setting the `type=admin-signature` parameter and specifying any provider user ID, allowing them to upload and overwrite provider signatures. This enables attackers with portal access to forge signatures on medical documents, potentially resulting in legal compliance violations and fraud.
OpenEMR's security advisory (GHSA-xc8x-mfh8-9xvh) and the fixing commit (a29c0f7ac0975429a85cd09a3ff12ee0dcdb4478) confirm that version 8.0.0 resolves the issue by implementing proper authorization checks. Security practitioners should prioritize upgrading affected OpenEMR instances to version 8.0.0 or later.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authorization bypass in public-facing OpenEMR patient portal directly enables T1190 exploitation for unauthorized actions; allows overwriting provider signature files, mapping to stored data manipulation under T1565.001.