CVE-2026-126440 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 has a missing authorization check in the Care Coordination CCDA and CCR import controllers. An authenticated non-administrator with Care Coordination access can recategorize protected patient documents and then download them.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Installations of OpenEMR before 8.5.0 where non-administrative users have Care Coordination access. Attackers need a valid account with that access; sites without Care Coordination users are less exposed. Managed hosting providers should confirm their version.
Not affected if no-care-coordination-users, openemr-8.5.0-or-later
Who cares healthcare, openemr, self-hosted
8.5.0 are affected.8.5.0 or later.OpenEMR before 8.5.0 contains a missing authorization flaw in the Care Coordination CCDA and CCR import controllers, which move a document named by the document_id parameter into the import category without checking access to the source document. Authenticated non-administrators with Care Coordination access can recategorize protected patient documents and then download them through normal ACL-checked retrieval.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.