What’s Vulnerable › Vulnerabilities

CVE-2022-1459: Non-Privilege User Can View Patient’s Disclosures in openemr/openemr

• Severity: high (CVSS 8.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-04-25 · updated 2026-06-17
• Weakness: CWE-1118

Description

Non-Privilege User Can View Patient’s Disclosures in GitHub repository openemr/openemr prior to 6.1.0.1.

Affected products

• openemr: before 6.1.0.1 — fixed in 6.1.0.1

How to fix

Upgrade to a fixed version: openemr 6.1.0.1. Check the vendor advisory for mitigations.

References

• https://github.com/openemr/openemr/commit/8f8a97724c0e8fcc4096b4b30af9aaf064ada45a
• https://huntr.dev/bounties/9023ca9b-a601-4e5d-8952-640c60d029f1
• https://github.com/openemr/openemr/commit/8f8a97724c0e8fcc4096b4b30af9aaf064ada45a
• https://huntr.dev/bounties/9023ca9b-a601-4e5d-8952-640c60d029f1

Get alerted when CVE-2022-1459 or the next vulnerability affects your stack