{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-01T08:50:19.619","vulnerabilities":[{"cve":{"id":"CVE-2026-25929","sourceIdentifier":"security-advisories@github.com","published":"2026-02-25T19:43:22.930","lastModified":"2026-06-17T10:25:26.700","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the document controller’s `patient_picture` context serves the patient’s photo by document ID or patient ID without verifying that the current user is authorized to access that patient. An authenticated user with document ACL can supply another patient’s ID and retrieve their photo. Version 8.0.0 fixes the issue."},{"lang":"es","value":"OpenEMR es una aplicación gratuita y de código abierto para registros de salud electrónicos y gestión de consultorios médicos. Antes de la versión 8.0.0, el contexto 'patient_picture' del controlador de documentos sirve la foto del paciente por ID de documento o ID de paciente sin verificar que el usuario actual esté autorizado para acceder a ese paciente. Un usuario autenticado con ACL de documento puede proporcionar el ID de otro paciente y recuperar su foto. La versión 8.0.0 soluciona el problema."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"openemr","product":"openemr","versions":[{"version":"< 8.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-02-26T21:07:22.603323Z","id":"CVE-2026-25929","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*","versionEndExcluding":"8.0.0","matchCriteriaId":"FEAA9896-A42E-437C-BEE8-8DA955E34385"}]}]}],"references":[{"url":"https://github.com/openemr/openemr/commit/fc4d00ecb63561dacd23cb1fed49c64bd1a83258","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-778w-r8rm-8qhq","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]}]}}]}