CVE-2026-44715 — OpenMRS has Broken Access Control in HL7 Configuration
OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR services. Specific…
Published: 2026-09-11 · CVSS: 8.7 · CVSS 4.0
OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR services. Specifically, the `startHl7ArchiveMigration` method is accessible, which should be restricted to admin-level accounts. Versions 1.23.0 and 2.10.0 patch the issue.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7