CVE-2026-126461

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.5.0

Description An authorization flaw exists in the 'library/ajax/user settings.php' endpoint. This issue allows any authenticated user to persist arbitrary global configuration overrides by sending POST requests with global:-prefixed keys. This can be used to redirect external service hosts, such as CouchDB, eRx, phiMail, or SMTP, to servers controlled by an attacker, leading to the exfiltration of system credentials and patient Protected Health Information (PHI).

Recommendations Update to version 8.5.0 or later.