CVE-2026-126444

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.5.0

Description The Ensora eRx integration contains a missing authorization flaw. Authenticated staff members who lack the required patients/rx permissions can access sensitive prescription data by sending direct requests to the 'eRx.php' endpoint. This allows the exposure of patient demographics, medication history, and allergy data within the vendor XML, and enables the unauthorized triggering of eRx synchronization state changes.

Recommendations Update to version 8.5.0 or later. Restrict direct access to the 'eRx.php' endpoint as a temporary mitigation measure.