CVE-2026-44715 — OpenMRS has Broken Access Control in HL7 Configuration

CVE-2026-44715

OpenMRS has Broken Access Control in HL7 Configuration PUBLISHED

Description (CNA)

OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR services. Specifically, the `startHl7ArchiveMigration` method is accessible, which should be restricted to admin-level accounts. Versions 1.23.0 and 2.10.0 patch the issue.

Affected (CNA)

Vendor / product	Versions
openmrs / org.openmrs.module:legacyui-api	affected < 1.23.0; affected >= 2.0.0, < 2.10.0

CWE

CWE-285

References

https://github.com/openmrs/openmrs-core/security/advisories/GHSA-g7rc-8fr4-5p2p

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.