OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the Message Center accepts the URL parameter `show_all=yes` and passes it to `getPnotesByUser()`, which returns all internal messages (all users’ notes). The backend does not verify that the requesting user is an administrator before honoring `show_all=yes`. The "Show All" link is also visible to non-admin users. As a result, any authenticated user can view the entire internal message list by requesting `messages.php?show_all=yes`. Version 8.0.0 patches the issue.
References
| Link | Resource |
|---|---|
| https://github.com/openemr/openemr/commit/9f2c44fc88fc051fcf0b6922c373977543e6b2af | Patch |
| https://github.com/openemr/openemr/security/advisories/GHSA-phcp-7qjx-83cm | Exploit Vendor Advisory |
| https://github.com/openemr/openemr/security/advisories/GHSA-phcp-7qjx-83cm | Exploit Vendor Advisory |
Configurations
History
27 Feb 2026, 14:41
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| CPE | cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:* | |
| First Time |
Open-emr openemr
Open-emr |
|
| References | () https://github.com/openemr/openemr/commit/9f2c44fc88fc051fcf0b6922c373977543e6b2af - Patch | |
| References | () https://github.com/openemr/openemr/security/advisories/GHSA-phcp-7qjx-83cm - Exploit, Vendor Advisory |
26 Feb 2026, 17:23
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/openemr/openemr/security/advisories/GHSA-phcp-7qjx-83cm - |
25 Feb 2026, 19:43
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-25 19:43
Updated : 2026-02-27 14:41
NVD link : CVE-2026-25220
Mitre link : CVE-2026-25220
CVE.ORG link : CVE-2026-25220
JSON object : View
Products Affected
open-emr
- openemr
CWE
CWE-639
Authorization Bypass Through User-Controlled Key