Improper access control in OpenEMR - CVE-2026-126448
Published: November 10, 2026 / Updated: November 13, 2026
Vulnerability identifier: #VU164462
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-126448
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to tamper with shared clinical-note templates, categories, contexts, and template assignments in OpenEMR deployments with Nation Notes enabled.
The vulnerability exists due to missing authorization and CSRF checks in the Nation Notes configuration handlers when processing mutation requests without enforcing nationnotes/nn_configure. A remote user can submit requests to ajax_code.php or add_context.php without that permission, or induce cross-site requests through a logged-in user, to modify shared templates and contexts, delete categories, or assign templates to arbitrary users.
Affected software
OpenEMR
How to mitigate CVE-2026-126448
Install security update from vendor's website.
OpenEMR - update to 8.5.0