CVE-2026-44715

HighCVSS 8.7

Published: 11/09/2026(UTC)Updated: 25/09/2026(UTC)Translated: 12/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.41%

32th percentile - higher than 32% of all known CVEs

Summary

OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR services. Specifically, the startHl7ArchiveMigration method is accessible, which should be restricted to admin-level accounts.

Risk Assessment

An authenticated user without admin privileges can trigger administrative operations, potentially leading to unauthorized changes in the system. This constitutes an access control violation.

Recommendation

Update OpenMRS to version 1.23.0 or 2.10.0 (or later), which contain the patch. Verify that access to DWR methods is properly restricted to admin-level accounts.

Other vulnerabilities in OpenMRS

CVE-2025-25925Medium
A stored cross-site scripting (XSS) vulnerability in OpenMRS v2.4.3 Build 0ff0ed allows attackers to inject malicious JavaScript or HTML into the personName.middleName parameter at /openmrs/admin/patients/shortPatientForm.form, leading to script execution in the victim's browser.

Original NVD description (English source)

OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR services. Specifically, the `startHl7ArchiveMigration` method is accessible, which should be restricted to admin-level accounts. Versions 1.23.0 and 2.10.0 patch the issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS