CVE-2026-126449 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 lets low-privileged, logged-in front office users skip access control checks in immunizations.php, diagnosis_full.php and billing_process.php. Those users can add or delete immunizations, write encounter billing codes and run the billing processor.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Clinics and organizations running self-hosted OpenEMR older than 8.5.0 with front office user accounts. Exposure depends on those authenticated users having access to the affected pages, so installations with only trusted staff accounts carry less risk.
Not affected if managed-hosting-patched, openemr-8.5.0-or-later
Who cares healthcare, openemr, self-hosted
8.5.08.5.0 or later (per the advisory range in the sources)OpenEMR before 8.5.0 contains a missing authorization vulnerability in immunizations.php, diagnosis_full.php, and billing_process.php that lets low-privileged users bypass ACL checks. Authenticated Front Office users can reuse their session CSRF token to add or delete immunizations, write encounter billing codes, and invoke the billing processor.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.