4 matches found
CVE-2026-33934
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have a missing authorization check in portal/sign/lib/show-signature.php that allows any authenticated patient portal user to retrieve the drawn signature image of an...
CVE-2026-33934 OpenEMR's Missing Authorization in show-signature.php Allows Portal Patients to Read Staff Signatures
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have a missing authorization check in portal/sign/lib/show-signature.php that allows any authenticated patient portal user to retrieve the drawn signature image of an...
CVE-2026-33934
OpenEMR prior to version 8.0.0.3 suffers a lack of authorization in portal/sign/lib/show-signature.php, permitting any authenticated patient portal user to read a staff member's drawn signature by posting an arbitrary user value. The companion write endpoint (save-signature.php) was hardened, but...
PT-2026-28154
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have a missing authorization check in portal/sign/lib/show-signature.php that allows any authenticated patient portal user to retrieve the drawn signature image of an...