Executive Summary

[{'type': 'paragraph', 'content': "CVE-2026-32126 is a high-severity authorization bypass vulnerability in OpenEMR versions prior to 8.0.0.1. It is caused by an inverted boolean condition in the ControllerRouter::route() method, which incorrectly enforces admin/super access control checks only on certain controllers ('review' and 'log') that have their own internal authorization, while skipping these checks on other Clinical Decision Rules (CDR) controllers such as alerts, ajax, edit, add, detail, and browse."}, {'type': 'paragraph', 'content': 'As a result, any authenticated user, regardless of their role, can access and perform administrative actions on these unprotected CDR controllers. This includes suppressing clinical decision support alerts system-wide, deleting or modifying clinical plans, and editing rule configurations—all operations that should require administrator privileges.'}, {'type': 'paragraph', 'content': 'The vulnerability arises because the global admin/super ACL check was removed from header.php and replaced with a flawed ControllerRouter implementation. Although the OpenEMR user interface hides these pages from non-admin users, direct URL access is not blocked, allowing unauthorized actions via crafted requests.'}, {'type': 'paragraph', 'content': 'This issue is fixed in OpenEMR version 8.0.0.1.'}] [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows any authenticated user to perform privileged administrative operations on the Clinical Decision Rules subsystem of OpenEMR, which can have serious impacts including:

• Suppressing clinical decision support alerts system-wide by modifying alert flags, potentially causing important clinical warnings to be missed.
• Deleting or modifying clinical plans and associated rules, which can disrupt patient care plans and clinical workflows.
• Editing rule configurations that govern clinical decision support, potentially leading to incorrect or unsafe clinical recommendations.

These unauthorized actions risk patient safety by allowing silent suppression of alerts and unauthorized changes to clinical data, undermining the integrity of the electronic health record system.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by attempting to access or perform administrative actions on Clinical Decision Rules (CDR) controllers such as alerts, ajax, edit, add, detail, and browse using an authenticated non-admin user account.'}, {'type': 'paragraph', 'content': 'Specifically, detection involves checking if non-admin users can suppress clinical decision support alerts or delete/modify clinical plans by sending crafted HTTP requests to exposed endpoints.'}, {'type': 'list_item', 'content': 'Use curl or similar tools to send POST requests to endpoints like deletePlan, togglePlanStatus, or commitChanges to see if these actions succeed without admin privileges.'}, {'type': 'list_item', 'content': 'Example command to test alert suppression (replace URL and parameters accordingly):'}, {'type': 'paragraph', 'content': "curl -X POST -b cookies.txt -d 'active_alert_flag=0&passive_alert_flag=0&patient_reminder_flag=0' https://your-openemr-instance/clinical_rules/ajax_endpoint"}, {'type': 'list_item', 'content': 'Example command to test clinical plan deletion:'}, {'type': 'paragraph', 'content': 'curl -X GET -b cookies.txt https://your-openemr-instance/clinical_rules/deletePlan?plan_id=123'}, {'type': 'paragraph', 'content': 'If these requests succeed for a non-admin user, the system is vulnerable.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade OpenEMR to version 8.0.0.1 or later, where this vulnerability is fixed.

Until the upgrade can be performed, restrict access to the affected Clinical Decision Rules controllers (alerts, ajax, edit, add, detail, browse) to only trusted administrator accounts.

Additionally, monitor and audit logs for any unauthorized access attempts to these endpoints.

Consider implementing network-level controls such as firewall rules or web application firewall (WAF) rules to block unauthorized requests to these sensitive endpoints.

Useful 0 Not Useful 0