{"id":"CVE-2026-126437","kind":"vulnerability","aliases":["CVE-2026-126437"],"related":[],"title":"OpenEMR: authorization bypass lets any core user read other patients' records","description":"OpenEMR before 8.5.0 contains an authorization bypass vulnerability in portal/lib/download_template.php that allows any authenticated core user to render documents for arbitrary patients by setting isModule. Attackers can submit arbitrary pid and template_id values to disclose patient names, birth dates, chart IDs, addresses, allergies, medications, and problem lists despite ACL and squad restrictions.","summary":"OpenEMR before 8.5.0 has an authorization bypass in portal/lib/download_template.php. Any authenticated core user can render documents for arbitrary patients by setting isModule and supplying arbitrary pid and template_id values, disclosing names, birth dates, addresses, allergies, medications and problem lists despite ACL restrictions.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","other","php","self-hosted"],"not_affected_if":["openemr-8.5.0-or-later"],"how_to_check":"- Check the installed OpenEMR version; it is affected if it is below `8.5.0`.\n- Look for `portal/lib/download_template.php` in the install and confirm whether it is reachable by logged-in users.","fix":"- Upgrade OpenEMR to `8.5.0` or later.","status":"open","published_at":"2026-11-13T10:17:50+00:00","first_seen_at":"2026-11-13T10:47:22+00:00","triaged_at":"2026-11-13T10:53:09+00:00","updated_at":"2026-11-13T10:53:09+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-13T10:53:09Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenEMR to `8.5.0` or later.","reach":"network","title":"OpenEMR: authorization bypass lets any core user read other patients' records","impact":"high","summary":"OpenEMR before 8.5.0 has an authorization bypass in portal/lib/download_template.php. Any authenticated core user can render documents for arbitrary patients by setting isModule and supplying arbitrary pid and template_id values, disclosing names, birth dates, addresses, allergies, medications and problem lists despite ACL restrictions.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","self-hosted","healthcare","php"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user reads any patient's medical records","analyst_note":"","how_to_check":"- Check the installed OpenEMR version; it is affected if it is below `8.5.0`.\n- Look for `portal/lib/download_template.php` in the install and confirm whether it is reachable by logged-in users.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["openemr-8.5.0-or-later"],"who_is_affected":"Any clinic or organization running OpenEMR before 8.5.0 with user accounts that are not fully trusted to see all patients. The flaw needs only a normal authenticated core user account, so anyone with staff login can reach it. Installations already on 8.5.0 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000737,"input_tokens":4634,"output_tokens":548,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126437':14A,17A '-2026':13A,16A '8.5.0':27B,70C 'acl':66B,117C 'address':59B,110C 'allergi':60B,111C 'allow':79C 'arbitrari':42B,49B,88C,96C 'attack':93C 'authent':35B,81C 'author':2A,30B,73C 'birth':57B,106C 'bypass':3A,31B,74C 'chart':108C 'contain':71C 'core':6A,36B,82C 'cve':12A,15A 'date':58B,107C 'despit':65B,116C 'disclos':55B,103C 'document':40B,86C 'healthcar':18B 'host':24B 'id':53B,100C,109C 'ismodul':46B,92C 'let':4A 'list':64B,115C 'medic':61B,112C 'name':56B,105C 'openemr':1A,19B,25B,68C 'patient':10A,43B,89C,104C 'php':21B 'pid':50B,97C 'portal/lib/download_template.php':33B,77C 'problem':63B,114C 'read':8A 'record':11A 'render':39B,85C 'restrict':67B,120C 'self':23B 'self-host':22B 'set':45B,91C 'squad':119C 'submit':95C 'suppli':48B 'templat':52B,99C 'user':7A,37B,83C 'valu':54B,101C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Any clinic or organization running OpenEMR before 8.5.0 with user accounts that are not fully trusted to see all patients. The flaw needs only a normal authenticated core user account, so anyone with staff login can reach it. Installations already on 8.5.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","other","php","selfhosted"],"campaign_type":null,"search_a":"'-126437':14A,17A '-2026':13A,16A 'author':2A 'bypass':3A 'core':6A 'cve':12A,15A 'let':4A 'openemr':1A 'patient':10A 'read':8A 'record':11A 'user':7A","search_b":"'8.5.0':27B 'acl':66B 'address':59B 'allergi':60B 'arbitrari':42B,49B 'authent':35B 'author':30B 'birth':57B 'bypass':31B 'core':36B 'date':58B 'despit':65B 'disclos':55B 'document':40B 'healthcar':18B 'host':24B 'id':53B 'ismodul':46B 'list':64B 'medic':61B 'name':56B 'openemr':19B,25B 'patient':43B 'php':21B 'pid':50B 'portal/lib/download_template.php':33B 'problem':63B 'render':39B 'restrict':67B 'self':23B 'self-host':22B 'set':45B 'suppli':48B 'templat':52B 'user':37B 'valu':54B","search_c":"'8.5.0':70C 'acl':117C 'address':110C 'allergi':111C 'allow':79C 'arbitrari':88C,96C 'attack':93C 'authent':81C 'author':73C 'birth':106C 'bypass':74C 'chart':108C 'contain':71C 'core':82C 'date':107C 'despit':116C 'disclos':103C 'document':86C 'id':100C,109C 'ismodul':92C 'list':115C 'medic':112C 'name':105C 'openemr':68C 'patient':89C,104C 'pid':97C 'portal/lib/download_template.php':77C 'problem':114C 'render':85C 'restrict':120C 'set':91C 'squad':119C 'submit':95C 'templat':99C 'user':83C 'valu':101C 'vulner':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:35:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126437","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126437","severity":null,"published_at":"2026-11-13T10:17:50+00:00","modified_at":"2026-11-13T10:17:50+00:00","first_seen_at":"2026-11-13T10:47:22+00:00","fetched_at":"2026-11-13T10:47:22+00:00","note":null}],"documents":[{"id":145118,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-vc2h-x8xf-8jcv","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:35:51+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145119,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-authorization-bypass-via-portal-lib-download-template-php","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}