CVE-2026-126468
Awaiting Analysis Awaiting Analysis - Queue

OpenEMR Missing Authorization in Reports and Reminders

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated low-privilege user to access reports, dated reminders, and batch reminder endpoints lacking AclMain::aclCheckCore() checks. Attackers can request patient_list.php, amc_full_report.php, dated_reminders_add.php, or batch_reminders.php directly to export patient PHI, send unauthorized reminders, and trigger batch reminder processing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126468
EUVD
EUVD-2026-124956

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
openemr openemr to 8.5.0 (exc)
openemr openemr 8.3.0-dev
openemr openemr 7.x
openemr openemr 8.x

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenEMR before version 8.5.0 has a missing authorization vulnerability where authenticated low-privilege users can access sensitive endpoints without proper permission checks. The flaw allows direct requests to patient_list.php, amc_full_report.php, dated_reminders_add.php, or batch_reminders.php to export patient PHI, send unauthorized reminders, or trigger batch reminder processing. This occurs because these endpoints lack AclMain::aclCheckCore() checks, relying only on session authentication.

Detection Guidance

Check OpenEMR version with: grep -r "version" /var/www/html/openemr/library/Common/Version.php. Look for endpoints patient_list.php, amc_full_report.php, dated_reminders_add.php, or batch_reminders.php in web server logs. Test direct access to these URLs with low-privilege credentials to verify unauthorized data exposure.

Impact Analysis

Attackers with low-privilege access can exploit this to export patient Protected Health Information (PHI), send unauthorized reminders, or trigger batch reminder processing. This risks exposing sensitive patient data, violating confidentiality, and potentially allowing unauthorized system actions. The impact includes data breaches, compliance violations, and loss of trust in the system.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to patient PHI. GDPR requires strict data access controls and breach notification, while HIPAA mandates safeguards for protected health information. Exploiting this flaw could lead to unauthorized data exposure, triggering compliance penalties, legal liabilities, and reputational damage for affected organizations.

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later immediately. Add AclMain::aclCheckCore() checks to affected endpoints. Review and restrict access to patient_list.php, amc_full_report.php, dated_reminders_add.php, and batch_reminders.php. Implement CSRF protection for write actions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126468. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...