GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for org.openmrs.module:legacyui-api by openmrs

    CVE-2026-44715 (GCVE-0-2026-44715)

    Vulnerability from nvd – Published: 2026-09-11 21:19 – Updated: 2026-09-11 21:19
    VLAI
    Title
    OpenMRS has Broken Access Control in HL7 Configuration
    Summary
    OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR services. Specifically, the `startHl7ArchiveMigration` method is accessible, which should be restricted to admin-level accounts. Versions 1.23.0 and 2.10.0 patch the issue.
    Severity
    8.7 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    openmrs org.openmrs.module:legacyui-api Affected: < 1.23.0
    Affected: >= 2.0.0, < 2.10.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "org.openmrs.module:legacyui-api",
          "vendor": "openmrs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.23.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.10.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR services. Specifically, the `startHl7ArchiveMigration` method is accessible, which should be restricted to admin-level accounts. Versions 1.23.0 and 2.10.0 patch the issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T21:19:00.414Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/openmrs/openmrs-core/security/advisories/GHSA-g7rc-8fr4-5p2p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/openmrs/openmrs-core/security/advisories/GHSA-g7rc-8fr4-5p2p"
        }
      ],
      "source": {
        "advisory": "GHSA-g7rc-8fr4-5p2p",
        "discovery": "UNKNOWN"
      },
      "title": "OpenMRS has Broken Access Control in HL7 Configuration"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44715",
    "datePublished": "2026-09-11T21:19:00.414Z",
    "dateReserved": "2026-05-07T17:07:09.319Z",
    "dateUpdated": "2026-09-11T21:19:00.414Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-44715 (GCVE-0-2026-44715)

    Vulnerability from cvelistv5 – Published: 2026-09-11 21:19 – Updated: 2026-09-11 21:19
    VLAI
    Title
    OpenMRS has Broken Access Control in HL7 Configuration
    Summary
    OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR services. Specifically, the `startHl7ArchiveMigration` method is accessible, which should be restricted to admin-level accounts. Versions 1.23.0 and 2.10.0 patch the issue.
    Severity
    8.7 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    openmrs org.openmrs.module:legacyui-api Affected: < 1.23.0
    Affected: >= 2.0.0, < 2.10.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "org.openmrs.module:legacyui-api",
          "vendor": "openmrs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.23.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.10.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR services. Specifically, the `startHl7ArchiveMigration` method is accessible, which should be restricted to admin-level accounts. Versions 1.23.0 and 2.10.0 patch the issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T21:19:00.414Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/openmrs/openmrs-core/security/advisories/GHSA-g7rc-8fr4-5p2p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/openmrs/openmrs-core/security/advisories/GHSA-g7rc-8fr4-5p2p"
        }
      ],
      "source": {
        "advisory": "GHSA-g7rc-8fr4-5p2p",
        "discovery": "UNKNOWN"
      },
      "title": "OpenMRS has Broken Access Control in HL7 Configuration"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44715",
    "datePublished": "2026-09-11T21:19:00.414Z",
    "dateReserved": "2026-05-07T17:07:09.319Z",
    "dateUpdated": "2026-09-11T21:19:00.414Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}