CVE-2026-126466

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.5.0

Description An authorization flaw allows authenticated users to create patient records and enumerate patient data by bypassing aclCheckCore() checks. This can be exploited by sending POST requests to the 'new comprehensive save.php' endpoint to create patients with insurance Protected Health Information (PHI), or by querying the 'new search popup.php' and 'patient select.php' endpoints to leak sensitive data such as names, Social Security Numbers (SSNs), and dates of birth (DOBs).

Recommendations Update to version 8.5.0 or later. As a temporary mitigation, restrict access to the 'new comprehensive save.php', 'new search popup.php', and 'patient select.php' endpoints.