CVE-2025-67645
Published: 28 January 2026
Summary
CVE-2025-67645 is a high-severity Improper Access Control (CWE-284) vulnerability in Open-Emr Openemr. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Account Manipulation (T1098); ranked at the 24.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-67645 is a broken access control vulnerability in the Profile Edit endpoint of OpenEMR, a free and open source electronic health records and medical practice management application. It affects all versions prior to 7.0.4, where an authenticated normal user can modify request parameters such as pubpid or pid to reference another user's record. The server accepts these modified IDs and applies changes to the targeted profile, enabling unauthorized alterations to user data like name and contact information. The vulnerability is classified under CWE-284 (Improper Access Control) with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An attacker with low-privilege authenticated access, such as a standard user, can exploit this over the network with low complexity and no user interaction required. By tampering with the pubpid or pid parameters in requests to the Profile Edit endpoint, the attacker can edit another user's profile details. This could facilitate account takeover by changing critical information, compromising confidentiality, integrity, and availability of affected records.
OpenEMR version 7.0.4 addresses the issue with a fix detailed in the commit at https://github.com/openemr/openemr/commit/e2a682ee71aac71a9f04ae566f4ffca10052bc4a. Additional mitigation guidance is available in the GitHub security advisory at https://github.com/openemr/openemr/security/advisories/GHSA-vjmv-cf46-gffv. Security practitioners should upgrade to 7.0.4 or later and review access controls on user profile endpoints.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206415
Vulnerability details
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.0.4 have a broken access control in the Profile Edit endpoint. An authenticated normal user can modify the request parameters (pubpid /…
more
pid) to reference another user’s record; the server accepts the modified IDs and applies the changes to that other user’s profile. This allows one user to alter another user’s profile data (name, contact info, etc.), and could enable account takeover. Version 7.0.4 fixes the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Broken access control (IDOR) on profile edit endpoint directly enables unauthorized modification of other users' account details, facilitating account takeover via T1098 Account Manipulation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 requires enforcement of approved authorizations for access to system resources, directly preventing authenticated users from editing other users' profiles via tampered pubpid/pid parameters in the Profile Edit endpoint.
SI-10 mandates validation of information inputs like pubpid and pid parameters to ensure they reference only the authenticated user's own record, blocking unauthorized profile modifications.
AC-6 applies least privilege to restrict normal authenticated users from accessing or modifying other users' profiles, complementing enforcement against parameter tampering.