CVE-2026-126468

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.5.0

Description An authorization flaw allows authenticated users with low privileges to access specific endpoints that lack AclMain::aclCheckCore() checks. This allows unauthorized access to reports, dated reminders, and batch reminder functions. By directly requesting the endpoints 'patient list.php', 'amc full report.php', 'dated reminders add.php', or 'batch reminders.php', an attacker can export patient Protected Health Information (PHI), send unauthorized reminders, or trigger batch reminder processing.

Recommendations Update to version 8.5.0 or later.