CVE-2026-126457 · Package
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 has a missing authorization check in InstallerController, so any authenticated user can change module settings without the admin/manage_modules permission. Low-privileged staff such as front office clerks can reconfigure or partially disable installed modules.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any OpenEMR installation before 8.5.0 where users have accounts is exposed, because the flaw needs only a logged-in session and no special permission. Installations where only admins can log in, or that run 8.5.0 or later, are not affected.
Not affected if no-user-accounts, version-8.5.0-or-later
Who cares healthcare, openemr, self-hosted
8.5.08.5.0 or laterOpenEMR before 8.5.0 contains a missing authorization vulnerability in InstallerController that allows any authenticated user to modify module administration settings without the admin/manage_modules permission. Low-privileged users such as Front Office clerks can POST to saveConfig, DeleteAcl, DeleteHooks and nickName actions to reconfigure or partially disable installed modules.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.