CVE-2026-44715

OpenMRS, an open-source electronic medical record platform, fails to properly restrict its administrative Direct Web Remoting (DWR) services in affected versions. Any user with valid login credentials, even without admin-level privileges, can remotely invoke the admin-only `startHl7ArchiveMigration` DWR method over the network. By calling this administrative service, an attacker gains unauthorized control over HL7 archive migration, driving a high impact to data integrity without confidentiality or availability loss per the CVSS 4.0 vector. All OpenMRS deployments prior to versions 1.23.0 and 2.10.0 are affected, primarily hospitals and clinics running older builds of the platform. No public proof-of-concept or in-the-wild exploitation is known, and the flaw is not listed in CISA's KEV catalog.

What to do: Upgrade OpenMRS to version 1.23.0 or 2.10.0 (whichever applies to your deployment line) or later. As interim mitigation, restrict or block untrusted network access to the platform's DWR endpoints (e.g., the /dwr/ path) at a reverse proxy or firewall, and audit recent HL7 archive migration activity for invocations by non-administrator accounts. Review which user accounts hold valid credentials, since any authenticated user could trigger the administrative service in unpatched versions.