Missing Authorization in OpenEMR - CVE-2026-126449
Published: November 10, 2026 / Updated: November 13, 2026
Vulnerability identifier: #VU164463
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-126449
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass authorization and modify medical and billing records without the required permissions.
The vulnerability exists due to missing authorization checks in OpenEMR's immunizations.php, diagnosis_full.php, and billing_process.php when handling requests from logged-in users, with immunization deletions also lacking patient binding. A remote user can obtain a session CSRF token from demographics.php and directly request these scripts to add or delete immunizations across patients, write encounter billing codes, and enter the billing processor.
Affected software
OpenEMR
How to mitigate CVE-2026-126449
Install security update from vendor's website.
OpenEMR - update to 8.5.0