CVE-2026-33302 in OpenEMR
Summary
by MITRE • 03/19/2026
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the module ACL function `AclMain::zhAclCheck()` only checks for the presence of any "allow" (user or group). It never checks for explicit "deny" (allowed=0). As a result, administrators cannot revoke access by setting a user or group to "deny"; if the user is in a group that has "allow," access is granted regardless of explicit denies. Version 8.0.0.2 fixes the issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 03/24/2026
The vulnerability identified as CVE-2026-33302 affects OpenEMR, a widely used open source electronic health records and medical practice management application. This security flaw resides within the Access Control List (ACL) functionality of the application, specifically in the `AclMain::zhAclCheck()` method that handles authorization decisions. The issue represents a fundamental flaw in the permission model implementation that undermines the intended security controls for access management within the medical records system.
The technical root cause of this vulnerability stems from a design flaw in the ACL checking mechanism where the system only evaluates positive permissions without properly considering negative permissions. When administrators attempt to revoke access from users or groups by setting explicit deny permissions, the system fails to honor these restrictions because the `zhAclCheck()` function operates under the assumption that if any "allow" permission exists for a user or group, access should be granted regardless of any conflicting "deny" settings. This logical error creates a privilege escalation scenario where users maintain access even when administrators have explicitly attempted to revoke their permissions.
The operational impact of this vulnerability is particularly severe in healthcare environments where strict access controls are paramount for patient privacy and compliance with regulations such as HIPAA. An attacker or malicious administrator could potentially exploit this weakness to maintain unauthorized access to sensitive medical records, bypassing the intended access control mechanisms. The vulnerability essentially renders the deny functionality useless, creating a security gap where administrators cannot effectively manage user permissions and enforce least privilege principles within the application. This flaw undermines the core security architecture of the system and could lead to data breaches or unauthorized access to confidential patient information.
This vulnerability aligns with CWE-284, which addresses improper access control issues, and demonstrates characteristics consistent with the ATT&CK technique T1078.004 related to valid accounts and credential access. The fix implemented in version 8.0.0.2 addresses the root cause by properly implementing explicit deny checking in the ACL evaluation process, ensuring that deny permissions take precedence over allow permissions when conflicts occur. Organizations using OpenEMR should immediately upgrade to version 8.0.0.2 or later to remediate this vulnerability. Additionally, security teams should conduct comprehensive audits of existing access controls and permissions within their OpenEMR installations to identify any potential unauthorized access that may have occurred due to this flaw, while also implementing monitoring for suspicious access patterns that could indicate exploitation attempts.