PT-2026-146734
CVE-2026-126448
·
Published
2026-11-13
·
Updated
2026-11-13
Description by
CVSS 3.1
4.3
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows authenticated users lacking nationnotes/nn configure to modify shared Nation Notes templates by calling mutation endpoints directly. Attackers can send requests to ajax code.php or add context.php, which lack ACL and CSRF checks, to tamper with clinical-note templates and assignments.
Found an issue in the description? Have something to add? Feel free to write us 👾