CVE-2026-126442 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 has a missing authorization check in create_portallogin.php, so a low-privilege logged-in user can replace patient portal credentials. An attacker can take over patient portal accounts, read protected health information, and lock patients out.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Clinics and organizations that run OpenEMR before 8.5.0 with the patient portal in use. The flaw sits in the portal login creation path, so deployments without the patient portal are less exposed. Sources do not say which default settings enable the portal.
Not affected if patient-portal-disabled, version-8.5.0-or-later
Who cares healthcare, openemr, php, self-hosted
8.5.0 are listed as affected.8.5.0 or later, per the product range in the source.OpenEMR before 8.5.0 contains a missing authorization vulnerability in create_portallogin.php that allows low-privilege authenticated users to replace patient portal credentials without ACL checks. Attackers can select a victim patient in session and post replacement credentials to take over portal accounts, read PHI, and lock patients out.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.