CVE-2026-126437 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 has an authorization bypass in portal/lib/download_template.php. Any authenticated core user can render documents for arbitrary patients by setting isModule and supplying arbitrary pid and template_id values, disclosing names, birth dates, addresses, allergies, medications and problem lists despite ACL restrictions.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any clinic or organization running OpenEMR before 8.5.0 with user accounts that are not fully trusted to see all patients. The flaw needs only a normal authenticated core user account, so anyone with staff login can reach it. Installations already on 8.5.0 or later are not affected.
Not affected if openemr-8.5.0-or-later
Who cares healthcare, openemr, php, self-hosted
8.5.0.portal/lib/download_template.php in the install and confirm whether it is reachable by logged-in users.8.5.0 or later.OpenEMR before 8.5.0 contains an authorization bypass vulnerability in portal/lib/download_template.php that allows any authenticated core user to render documents for arbitrary patients by setting isModule. Attackers can submit arbitrary pid and template_id values to disclose patient names, birth dates, chart IDs, addresses, allergies, medications, and problem lists despite ACL and squad restrictions.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.