CVE-2026-33304

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0.2

Description OpenEMR is an electronic health records and medical practice management application. A flaw exists where an authenticated, non-administrator user can view reminder messages belonging to other users. This is achieved by manipulating the sentTo[] or sentBy[] parameters in a GET request to the dated reminders log. The issue allows access to patient names and the content of free-text messages.

Recommendations Update to OpenEMR version 8.0.0.2 or later.