Improper access control in OpenEMR - #VU164459
Published: November 10, 2026
Vulnerability identifier: #VU164459
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to tamper with shared clinical templates and disrupt practice-wide workflows.
The vulnerability exists due to unconditional authorization in OpenEMR CAMOS new.php through myAuth(), compounded by missing CSRF verification, when processing template administration requests on deployments with CAMOS installed and enabled. A remote user can submit direct POST requests or induce forged requests through a signed-in user’s browser to create, modify, or recursively delete shared categories, items, and template content without administrator permission.
Affected software
OpenEMR
Remediation
Install security update from vendor's website.
OpenEMR - update to 8.5.0