CVE-2024-26476: open-emr · Server-Side Request Forgery (SSRF)
Source CVE Database V5
Not known to be exploited · CVSS 3.5 Low · fixed in 7.0.2 : update affected systems when convenient.
Data as of 26 Oct 2026, 14:05 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 35% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 7.0.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 28 Feb 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
Organizations should upgrade OpenEMR installations to version 7.0.2 or later, where this vulnerability is fixed. Until patching is possible, restrict access to the ereq_form.php component and monitor logs for unusual activity involving the formid parameter. Implement strict access controls to minimize the number of users with privileges that could be leveraged for escalation. Employ web application firewalls (WAFs) with rules to detect and block suspicious input patterns targeting formid or similar parameters. Conduct regular security audits and user activity monitoring to detect early signs of exploitation attempts. Educate users about the risks of executing untrusted scripts or actions that could trigger this vulnerability.
Description
An issue in open-emr before v.7.0.2 allows a remote attacker to escalate privileges via a crafted script to the formid parameter in the ereq_form.php component.