Missing Authorization in OpenEMR Lets Low-Privileged Users Bypass ACL Checks

Executive Summary

CVE-2026-126449 is a missing authorization vulnerability in OpenEMR versions before 8.5.0. It affects three files: immunizations.php, diagnosis_full.php, and billing_process.php. Low-privileged users like Front Office staff can bypass access control checks by reusing their session CSRF token. This allows unauthorized modifications to medical records, billing codes, and immunizations without proper permissions.

Useful 0 Not Useful 0

Detection Guidance

Check OpenEMR version with: grep -r "version" /var/www/html/openemr/library/sql.inc.php. Inspect files immunizations.php, diagnosis_full.php, and billing_process.php for missing ACL checks. Monitor logs for unauthorized modifications to medical records or billing codes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows low-privileged users to add, delete, or modify medical records, billing codes, and immunizations without authorization. For example, a Front Office user could delete immunizations across different patient IDs or write encounter billing codes. The exploit requires a valid session cookie and CSRF token, but no additional user interaction.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability compromises data integrity in medical and billing records, which could violate compliance with standards like HIPAA (requiring patient data protection) and GDPR (requiring data accuracy and security). Unauthorized modifications to records may lead to legal and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later immediately. Apply ACL checks to immunizations.php, diagnosis_full.php, and billing_process.php. Bind delete operations to the session user's patient ID to prevent unauthorized access.

Useful 0 Not Useful 0