{"id":"CVE-2026-126442","kind":"vulnerability","aliases":["CVE-2026-126442"],"related":[],"title":"OpenEMR: low-privilege users can reset patient portal logins","description":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in create_portallogin.php that allows low-privilege authenticated users to replace patient portal credentials without ACL checks. Attackers can select a victim patient in session and post replacement credentials to take over portal accounts, read PHI, and lock patients out.","summary":"OpenEMR before 8.5.0 has a missing authorization check in create_portallogin.php, so a low-privilege logged-in user can replace patient portal credentials. An attacker can take over patient portal accounts, read protected health information, and lock patients out.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","other","php","self-hosted"],"not_affected_if":["patient-portal-disabled","version-8.5.0-or-later"],"how_to_check":"- Check the OpenEMR version in use; versions before `8.5.0` are listed as affected.\n- Confirm whether the patient portal is enabled in the deployment.","fix":"- OpenEMR: move to `8.5.0` or later, per the product range in the source.","status":"open","published_at":"2026-11-13T10:17:51+00:00","first_seen_at":"2026-11-13T10:47:22+00:00","triaged_at":"2026-11-13T10:50:47+00:00","updated_at":"2026-11-13T10:50:47+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T10:50:47Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.5.0` or later, per the product range in the source.","reach":"network","title":"OpenEMR: low-privilege users can reset patient portal logins","impact":"high","summary":"OpenEMR before 8.5.0 has a missing authorization check in create_portallogin.php, so a low-privilege logged-in user can replace patient portal credentials. An attacker can take over patient portal accounts, read protected health information, and lock patients out.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker takes over patient portal accounts and reads health records","analyst_note":"Confirm the patient portal default state and the exact fixed version from the vendor advisory at github.com.","how_to_check":"- Check the OpenEMR version in use; versions before `8.5.0` are listed as affected.\n- Confirm whether the patient portal is enabled in the deployment.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-8.5.0-or-later","patient-portal-disabled"],"who_is_affected":"Clinics and organizations that run OpenEMR before 8.5.0 with the patient portal in use. The flaw sits in the portal login creation path, so deployments without the patient portal are less exposed. Sources do not say which default settings enable the portal.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00073,"input_tokens":4602,"output_tokens":539,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126442':13A,16A '-2026':12A,15A '8.5.0':26B,65C 'account':55B,104C 'acl':86C 'allow':74C 'attack':49B,88C 'authent':78C 'author':30B,69C 'check':31B,87C 'contain':66C 'create_portallogin.php':33B,72C 'credenti':47B,84C,99C 'cve':11A,14A 'health':58B 'healthcar':17B 'host':23B 'inform':59B 'lock':61B,108C 'log':40B 'logged-in':39B 'login':10A 'low':3A,37B,76C 'low-privileg':2A,36B,75C 'miss':29B,68C 'openemr':1A,18B,24B,63C 'patient':8A,45B,53B,62B,82C,93C,109C 'phi':106C 'php':20B 'portal':9A,46B,54B,83C,103C 'post':97C 'privileg':4A,38B,77C 'protect':57B 'read':56B,105C 'replac':44B,81C,98C 'reset':7A 'select':90C 'self':22B 'self-host':21B 'session':95C 'take':51B,101C 'user':5A,42B,79C 'victim':92C 'vulner':70C 'without':85C","nicknames":[],"mitigations":[],"who_affected":"Clinics and organizations that run OpenEMR before 8.5.0 with the patient portal in use. The flaw sits in the portal login creation path, so deployments without the patient portal are less exposed. Sources do not say which default settings enable the portal.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","other","php","selfhosted"],"campaign_type":null,"search_a":"'-126442':13A,16A '-2026':12A,15A 'cve':11A,14A 'login':10A 'low':3A 'low-privileg':2A 'openemr':1A 'patient':8A 'portal':9A 'privileg':4A 'reset':7A 'user':5A","search_b":"'8.5.0':26B 'account':55B 'attack':49B 'author':30B 'check':31B 'create_portallogin.php':33B 'credenti':47B 'health':58B 'healthcar':17B 'host':23B 'inform':59B 'lock':61B 'log':40B 'logged-in':39B 'low':37B 'low-privileg':36B 'miss':29B 'openemr':18B,24B 'patient':45B,53B,62B 'php':20B 'portal':46B,54B 'privileg':38B 'protect':57B 'read':56B 'replac':44B 'self':22B 'self-host':21B 'take':51B 'user':42B","search_c":"'8.5.0':65C 'account':104C 'acl':86C 'allow':74C 'attack':88C 'authent':78C 'author':69C 'check':87C 'contain':66C 'create_portallogin.php':72C 'credenti':84C,99C 'lock':108C 'low':76C 'low-privileg':75C 'miss':68C 'openemr':63C 'patient':82C,93C,109C 'phi':106C 'portal':83C,103C 'post':97C 'privileg':77C 'read':105C 'replac':81C,98C 'select':90C 'session':95C 'take':101C 'user':79C 'victim':92C 'vulner':70C 'without':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:43:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126442","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126442","severity":null,"published_at":"2026-11-13T10:17:51+00:00","modified_at":"2026-11-13T10:17:51+00:00","first_seen_at":"2026-11-13T10:47:22+00:00","fetched_at":"2026-11-13T10:47:22+00:00","note":null}],"documents":[{"id":145128,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-83hq-c876-fcwf","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:43:06+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145129,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-create-portallogin-php-portal-takeover","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}