CVE-2026-115573

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description In the file library/classes/Controller.class.php, the checkControllerAcl() function fails to enforce permissions for controllers missing from the CONTROLLER ACL MAP. This fail-open dispatcher allows a low-privilege authenticated user to bypass access control lists (ACL) and invoke administrative controllers. Specifically, an attacker can use C X12Partner::edit action process() to create or modify insurance-routing hosts and credentials, or use C PatientFinder::find action process() to enumerate patient identifiers, names, and dates of birth. This issue also exposes other administrative controllers intended to be restricted via Practice Settings routes.

Recommendations Update to version 8.3.0.