PT-2026-146759

CVE-2026-126474

Published

2026-11-13

Updated

2026-11-13

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.5.0

Description The ACL module contains a reflected cross-site scripting issue. This occurs when unencoded input is injected into inline script blocks via the module id parameter in the 'acl/index' or 'acl/acl' endpoints. An attacker can use this to execute JavaScript within authenticated sessions, potentially stealing non-HttpOnly session cookies or modifying ACL configuration.

Recommendations Update to version 8.5.0 or later. As a temporary mitigation, restrict access to the 'acl/index' and 'acl/acl' endpoints.

Exploitability

Exploit

Fix

Impacts

Researchers

Milo2012

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers