CVE-2026-32123

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-32123

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32123.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-32123

Aliases

GHSA-j4mm-wg7q-v57q

Published

2026-03-11T20:49:38Z

Modified

2026-08-12T03:51:39Z

Severity

7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator

Summary

OpenEMR: Therapy Group Sensitivity ACL No Longer Enforced

Details

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, sensitivity checks for group encounters are broken because the code only consults form_encounter for sensitivity, while group encounters store sensitivity in form_groups_encounter. As a result, sensitivity is never correctly applied to group encounters, and users who should be restricted from viewing sensitive (e.g. mental health) encounters can view them. This vulnerability is fixed in 8.0.0.1.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32123.json"
}

References

Affected packages

Git / github.com/openemr/openemr

Affected ranges

Type

GIT

Repo

https://github.com/openemr/openemr

Events

Introduced

Fixed

772513b42925374c6a471c770cdfbee8d5eb933f

Database specific

Show details

{
    "cpe": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "8.0.0.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

Other

v2_7_2

v2_7_2-rc1

v2_7_2-rc2

v2_7_3-rc1

v2_8_0

v2_8_1

v2_8_2

v2_8_3

v2_9_0

v3_0_0

v3_0_1

v8_0_0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32123.json"