ANT-2026-CVX8213H · openmrs-module-fhir2 · Deserialization / XXE

deserialization high Severity Claude high · Security research firm high · Maintainer - REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ophion Security. ANT-2026-CVX8213H: XXE injection via XML patch processing in third-party library HTTP PATCH reques...

CVE-2025-46823

openmrs-module-fhir2 provides the FHIR REST API and related services for OpenMRS, an open medical records system. In versions of the FHIR2 module prior to 2.5.0, privileges were not always correctly checked, which means that unauthorized users may have been able to add or edit data they were not...

CVE-2025-46823: Missing Authorization

openmrs-module-fhir2 provides the FHIR REST API and related services for OpenMRS, an open medical records system. In versions of the FHIR2 module prior to 2.5.0, privileges were not always correctly checked, which means that unauthorized users may have been able to add or edit data they were not...

PT-2025-23187 · Openmrs · Openmrs-Module-Fhir2

Name of the Vulnerable Software and Affected Versions: openmrs-module-fhir2 versions prior to 2.5.0 Description: The issue concerns the openmrs-module-fhir2, which provides the FHIR REST API and related services for OpenMRS, an open medical records system. In versions prior to 2.5.0, privileges...