OpenEMR up to 7.x FHIR CareTeam Resource Endpoint FhirCareTeamService information disclosure

Summaryinfo

A vulnerability was found in OpenEMR up to 7.x. It has been rated as problematic. The affected element is the function FhirCareTeamService of the component FHIR CareTeam Resource Endpoint. The manipulation leads to information disclosure. This vulnerability is uniquely identified as CVE-2026-24487. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in OpenEMR up to 7.x and classified as problematic. This issue affects the function FhirCareTeamService of the component FHIR CareTeam Resource Endpoint. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an authorization bypass vulnerability in the FHIR CareTeam resource endpoint allows patient-scoped FHIR tokens to access care team data for all patients instead of being restricted to only the authenticated patient's data. This could potentially lead to unauthorized disclosure of Protected Health Information (PHI), including patient-provider relationships and care team structures across the entire system. The issue occurs because the `FhirCareTeamService` does not implement the `IPatientCompartmentResourceService` interface and does not pass the patient binding parameter to the underlying service, bypassing the patient compartment filtering mechanism. Version 8.0.0 contains a patch for this issue.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-24487 since 01/23/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 8.0.0 eliminates this vulnerability. Applying the patch 5ce10a3961b73862aaf31eb30044ffe1018465cc is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Business Process Management Software

Name

• OpenEMR

Version

• 7.x

License

• open-source

Website

• Product: https://github.com/openemr/openemr/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion