CVE-2026-126448 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 lets authenticated users without the nationnotes/nn_configure permission change shared Nation Notes templates by calling mutation endpoints directly. An attacker can alter clinical-note templates and assignments, since ajax_code.php and add_context.php lack access control and CSRF checks.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Deployments of OpenEMR before 8.5.0 with user accounts that lack the nationnotes/nn_configure permission. The sources do not say whether managed hosting or default configurations differ.
Not affected if openemr-8.5.0-or-later
Who cares healthcare, openemr, self-hosted
8.5.0 or later is not affected.8.5.0 or later.OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows authenticated users lacking nationnotes/nn_configure to modify shared Nation Notes templates by calling mutation endpoints directly. Attackers can send requests to ajax_code.php or add_context.php, which lack ACL and CSRF checks, to tamper with clinical-note templates and assignments.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.