Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, an authorization bypass in the dated reminders log allows any authenticated non-admin user to view reminder messages belonging to other users, including associated patient names and free-text message content, by crafting a GET request with arbitrary user IDs in the `sentTo[]` or `sentBy[]` parameters. Version 8.0.0.2 fixes the issue.

INFO

Published Date :

2026-03-19T20:27:00.840Z

Last Modified :

2026-03-20T19:27:51.911Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-33304 vulnerability.

Vendors Products
Open-emr
  • Openemr
Openemr
  • Openemr
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-33304.

URL Resource
https://github.com/openemr/openemr/commit/21dee7658a5f3b18c5750e3fae7324e875c1703a cve-icon cve-icon
https://github.com/openemr/openemr/security/advisories/GHSA-66j9-ffq4-h222 cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact