CVE-2026-44715CWE-285

CVE-2026-44715

published September 12, 2026

CVSS
8.7
EPSS
0%
Percentile
33.7
In the wild
Unconfirmed
What it is

OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR services. Specifically, the `startHl7ArchiveMigration` method is accessible, which should be restricted to admin-level accounts. Versions 1.23.0 and 2.10.0 patch the issue.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00406 · 33.7th percentile
Weakness
CWE-285 · Improper Authorization
Published
2026-09-12T02:16Z
References (1)
https://github.com/openmrs/openmrs-core/security/advisories/GHSA-g7rc-8fr4-5p2p · [email protected]
EPSS history
Timeline
  • 13 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 11 SEP 21:19Z
    OpenMRS has Broken Access Control in HL7 Configuration
    cvelistv5