CVE-2026-126479
Awaiting Analysis Awaiting Analysis - Queue

OpenEMR Missing Authorization in Module Manager Actions

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
OpenEMR before 8.5.0 contains a missing authorization vulnerability in five Module Manager InstallerController actions that lack the admin/manage_modules ACL check and CSRF validation. Low-privilege users such as Front Office accounts can POST to saveConfig or SaveHooks to overwrite any module's configuration, retarget CCDA and HIE settings, and delete module hooks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126479
EUVD
EUVD-2026-124945

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openemr openemr to 8.5.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-126479 is a missing authorization vulnerability in OpenEMR versions before 8.5.0. Five Module Manager actions (saveConfigAction, configureAction, SaveHooksAction, DeleteHooksAction, nickNameAction) lack proper admin privilege checks and CSRF validation. Low-privilege users like Front Office accounts can exploit this to modify module configurations, delete hooks, or retarget settings via crafted POST requests.

Detection Guidance

Check OpenEMR versions prior to 8.5.0 by running commands like 'grep -r "openemr" /var/www/html' or checking the version in the OpenEMR interface. Monitor network traffic for POST requests to endpoints like /saveConfig, /SaveHooksAction, or /configureAction from non-admin users.

Impact Analysis

An attacker with low privileges could overwrite module configurations, delete hooks, or alter CCDA/HIE settings. This may lead to unauthorized system changes, data exposure, or service disruption. The impact includes high integrity risks and low confidentiality risks.

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later immediately. Ensure all POST actions in Module Manager InstallerController include CSRF token validation and admin/manage_modules ACL checks. Review and restrict user privileges to prevent low-privilege accounts from accessing sensitive endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126479. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...