CVE-2018-15152

Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before...

9.1 CriticalPublic exploit

Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker to access (1) portal/add_edit_event_user.php, (2) portal/find_appt_popup_user.php, (3) portal/get_allergies.php, (4) portal/get_amendments.php, (5) portal/get_lab_results.php, (6) portal/get_medications.php, (7) portal/get_patient_documents.php, (8) portal/get_problems.php, (9) portal/get_profile.php, (10) portal/portal_payment.php, (11) portal/messaging/messages.php, (12) portal/messaging/secure_chat.php, (13) portal/report/pat_ledger.php, (14) portal/report/portal_custom_report.php, or (15) portal/report/portal_patient_report.php without authenticating as a patient.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

25.0%Up 23.7 points since Apr 14, 2021

What each source reports

NVD Score used 9.1

Record: CVE-2018-15152
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0: 6.4 MediumAV:N/AC:L/Au:N/C:P/I:P/A:N
Weakness: CWE-287
Updated: 2026-11-02

CVE List No score

Record: CVE-2018-15152
Updated: 2026-11-02

EUVDEUVD-2018-7032 No score

Record: EUVD-2018-7032
Updated: 2026-11-03

GitHub AdvisoriesGHSA-rgrj-v63m-534x 9.1

Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before...

Record: GHSA-rgrj-v63m-534x
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-287
Updated: 2026-11-02

OSV 9.1

Record: CVE-2018-15152
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

Affected products

open-emr openemr

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	OpenEMR 5.0.1.3 - Authentication Bypass	2021-06-16

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-15152 is a critical vulnerability (CVSS 9.1) in Open-emr Openemr, published August 15, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 25.0%, the 97th percentile. No source names a fixed version.