{"id":"CVE-2026-115573","kind":"vulnerability","aliases":["CVE-2026-115573"],"related":[],"title":"OpenEMR: missing access checks let low-privilege users reach patient data","description":"OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/classes/Controller.class.php allows explicit controller.php dispatch to controllers missing from CONTROLLER_ACL_MAP, and checkControllerAcl() returns without enforcing any permission for those entries. A low-privilege authenticated user can invoke C_X12Partner::edit_action_process() to create or alter insurance-routing hosts and credentials, or invoke C_PatientFinder::find_action_process() to enumerate patient names, dates of birth, and identifiers. The shared fail-open dispatcher root cause also exposes other administrative controllers that were intended to be reached through ACL-gated Practice Settings routes. This issue is fixed in version 8.3.0.","summary":"OpenEMR, an electronic health records application, has a controller dispatch path that skips permission checks for some controllers. A logged-in low-privilege user can read patient names, dates of birth and identifiers, and change insurance-routing hosts and credentials.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","php","runtime","self-hosted"],"not_affected_if":["managed-hosting","version-8.3.0-or-later"],"how_to_check":"- Check the installed OpenEMR version against the fixed version below.\n- Look for `library/classes/Controller.class.php` and confirm whether `checkControllerAcl()` exists in the installed code.","fix":"- OpenEMR: upgrade to `8.3.0` or later.","status":"open","published_at":"2026-11-05T20:17:42+00:00","first_seen_at":"2026-11-05T20:40:44+00:00","triaged_at":"2026-11-05T20:42:57+00:00","updated_at":"2026-11-05T20:42:57+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-05T20:42:57Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: upgrade to `8.3.0` or later.","reach":"network","title":"OpenEMR: missing access checks let low-privilege users reach patient data","impact":"high","summary":"OpenEMR, an electronic health records application, has a controller dispatch path that skips permission checks for some controllers. A logged-in low-privilege user can read patient names, dates of birth and identifiers, and change insurance-routing hosts and credentials.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated low-privilege user reads patient records and alters insurance credentials","analyst_note":"","how_to_check":"- Check the installed OpenEMR version against the fixed version below.\n- Look for `library/classes/Controller.class.php` and confirm whether `checkControllerAcl()` exists in the installed code.","plain_action":"","needs_analyst":false,"not_affected_if":["managed-hosting","version-8.3.0-or-later"],"who_is_affected":"Clinics and practices that run OpenEMR themselves and let staff with low-level accounts log in are exposed. Hosted or managed OpenEMR depends on the provider applying the update. Installations on 8.3.0 or later are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000698,"input_tokens":4417,"output_tokens":512,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115573':15A,18A '-2026':14A,17A '8.3.0':86C,180C 'access':3A 'acl':97C,169C 'acl-gat':168C 'action':120C,137C 'administr':159C 'allow':88C 'also':156C 'alter':125C 'applic':31B,83C 'authent':113C 'birth':58B,145C 'c':117C,134C 'caus':155C 'chang':62B 'check':4A,40B 'checkcontrolleracl':100C 'control':34B,43B,93C,96C,160C 'controller.php':90C 'creat':123C 'credenti':68B,131C 'cve':13A,16A 'data':12A 'date':56B,143C 'dispatch':35B,91C,153C 'edit':119C 'electron':28B,76C 'enforc':103C 'entri':108C 'enumer':140C 'explicit':89C 'expos':157C 'fail':151C 'fail-open':150C 'find':136C 'fix':177C 'free':72C 'gate':170C 'health':29B,77C 'healthcar':19B 'host':25B,66B,129C 'identifi':60B,147C 'insur':64B,127C 'insurance-rout':63B,126C 'intend':163C 'invok':116C,133C 'issu':175C 'let':5A 'library/classes/controller.class.php':87C 'log':46B 'logged-in':45B 'low':7A,49B,111C 'low-privileg':6A,48B,110C 'manag':82C 'map':98C 'medic':80C 'miss':2A,94C 'name':55B,142C 'open':74C,152C 'openemr':1A,20B,26B,69C 'path':36B 'patient':11A,54B,141C 'patientfind':135C 'permiss':39B,105C 'php':21B 'practic':81C,171C 'prior':84C 'privileg':8A,50B,112C 'process':121C,138C 'reach':10A,166C 'read':53B 'record':30B,78C 'return':101C 'root':154C 'rout':65B,128C,173C 'runtim':22B 'self':24B 'self-host':23B 'set':172C 'share':149C 'skip':38B 'sourc':75C 'user':9A,51B,114C 'version':179C 'without':102C 'x12partner':118C","nicknames":[],"mitigations":[],"who_affected":"Clinics and practices that run OpenEMR themselves and let staff with low-level accounts log in are exposed. Hosted or managed OpenEMR depends on the provider applying the update. Installations on 8.3.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","php","runtime","selfhosted"],"campaign_type":null,"first_public_at":"2026-08-18T08:36:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115573","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115573","severity":null,"published_at":"2026-11-05T20:17:42+00:00","modified_at":"2026-11-05T20:17:42+00:00","first_seen_at":"2026-11-05T20:40:44+00:00","fetched_at":"2026-11-05T20:40:44+00:00","note":null}],"documents":[{"id":79834,"url":"https://github.com/openemr/openemr/commit/64f8491d850b2e22ed4fceb14fa67e27fef62cd1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79793,"url":"https://github.com/openemr/openemr/releases/tag/v8_3_0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79836,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-9rj4-fxmj-c4r7","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-18T08:36:28+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}