CVE-2025-46823 - CVE House
Back to Database
Status published High CVE-2025-46823

OpenMRS has Vulnerability in FHIR2 Module Privileges

Vulnerability Description

openmrs-module-fhir2 provides the FHIR REST API and related services for OpenMRS, an open medical records system. In versions of the FHIR2 module prior to 2.5.0, privileges were not always correctly checked, which means that unauthorized users may have been able to add or edit data they were not supposed to be able to. All implementers should update to FHIR2 2.5.0 or newer as soon as is feasible to receive a patch.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-46823

Credits & Attribution

No credits recorded in the NVD database.

References

More from openmrs

View All →
CVE-2022-23612
Directory Traversal in OpenMRS Startup Filter
High 7.5
CVE-2021-43094
An SQL Injection vulnerability exists in OpenMRS Reference Application Standalone...
Critical 9.8
CVE-2020-24621
A remote code execution (RCE) vulnerability was discovered in the...
High 8.8
CVE-2018-19276
OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization...
Critical 10
CVE-2018-16521
An XML External Entity (XXE) vulnerability exists in HTML Form...
Critical 9.8

Affected Vendor

Affected Software

openmrs-module-fhir2
Vulnerable Versions:
< 2.5.0

Timeline

Official Publish: May 29th, 2025
Last Modified: May 29th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-862

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1078 Valid Accounts
Persistence
T1531 Account Access Removal
Impact