SEPTEMBER 18, 2026
Live Feed
Back to database
Case File

CVE-2026-40509

MEDIUM · CVSS 4.3 EPSS 0.13% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-19 · Last synced 2026-09-18

CyberRota Analysis

AI-Generated

OpenEMR versions prior to 8.3.0 are vulnerable to a cross-site request forgery (CSRF) attack in the DICOM viewer, where the unsanitized web_path GET parameter allows attackers to manipulate authenticated user sessions. This vulnerability can lead to unauthorized actions such as forced logouts and other state changes by exploiting users with Patients - Documents permissions. Organizations using affected versions should prioritize patching to mitigate potential exploitation risks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-40509
Severity
MEDIUM
CVSS
4.3
EPSS
0.13%

Original NVD Description

OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The web_path GET parameter in the DICOM viewer page is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a URL that causes an authenticated user with Patients - Documents permissions to make authenticated requests to arbitrary OpenEMR endpoints, enabling forced logout and other state-changing actions.