CVE-2025-25928

Summary

CVE-2025-25928 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Openmrs version 2.4.3 Build 0ff0ed. The flaw, located in the /admin/users/user.form component, enables attackers to execute arbitrary operations by crafting malicious requests. Specifically, an attacker can exploit this vulnerability to elevate a low-privileged account to an administrative role. This poses a significant risk, as unauthorized administrators could make unintended changes to system configurations or sensitive data. System administrators are advised to apply relevant patches or updates to address this issue promptly.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.