CVE-2021-25920: Open-EMR Openemr

Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days.

In OpenEMR, versions v2.7.2-rc1 to 6.0.0 are vulnerable to Improper Access Control when creating a new user, which leads to a malicious user able to read and send sensitive messages on behalf of the victim user.

Affected products

• Open-EMR Openemr: from 2.7.2, up to and including 6.0.0

Published 2021-03-22. Last modified 2026-06-17.