Missing Authorization in OpenEMR Nation Notes Templates

Executive Summary

CVE-2026-126448 is a missing authorization vulnerability in OpenEMR versions before 8.5.0. It allows authenticated users without the nationnotes/nn_configure permission to modify shared Nation Notes templates by directly accessing mutation endpoints in files like ajax_code.php and add_context.php. These endpoints lack proper Access Control List (ACL) and Cross-Site Request Forgery (CSRF) checks, enabling tampering with clinical-note templates and assignments.

Useful 0 Not Useful 0

Detection Guidance

Check OpenEMR versions prior to 8.5.0 for unauthorized modifications to Nation Notes templates. Inspect mutation endpoints in ajax_code.php and add_context.php for missing ACL and CSRF checks. Monitor logs for suspicious requests to these files from authenticated users without nationnotes/nn_configure permissions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with an authenticated staff account to modify, delete, or assign clinical-note templates without proper permissions. This could lead to unauthorized changes in shared documentation templates, workflow disruption, or tampering with patient records. The attack requires only an authenticated account and has low complexity.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by allowing unauthorized modifications to clinical-note templates. Tampering with patient records or documentation workflows may violate data integrity and confidentiality requirements, potentially leading to legal and regulatory penalties for affected organizations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later. Enforce nationnotes/nn_configure permission checks on mutation endpoints. Add CSRF validation to ajax_code.php and add_context.php. Review and audit template modifications for unauthorized changes.

Useful 0 Not Useful 0