CVE-2026-33915
MEDIUMOpenEMR Missing ACL Checks on Insurance Company API Routes
Title source: cnaDescription
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, five insurance company REST API routes are missing the `RestConfig::request_authorization_check()` call that every other data-modifying route in the standard API uses. This allows any authenticated API user to create and modify insurance company records even if their OpenEMR user account does not have administrative ACL permissions. Version 8.0.0.3 patches the issue.
References (3)
Scores
CVSS v3
5.4
EPSS
0.0004
EPSS Percentile
11.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-862
Status
published
Products (2)
open-emr/openemr
< 8.0.0.3
openemr/openemr
< 8.0.0.3
Published
Mar 26, 2026
Tracked Since
Mar 26, 2026