CVE-2026-126461 · Package
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 lets any authenticated user save arbitrary global configuration overrides through user_settings.php. An attacker can point service hosts such as CouchDB, eRx, phiMail, or SMTP at servers they control, capturing system credentials and patient health information.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any OpenEMR deployment before 8.5.0 where users have logins, since any authenticated account can reach the vulnerable endpoint. Clinics and hospitals running self-hosted OpenEMR should prioritize this because patient records and service credentials are exposed. Instances already on 8.5.0 or later are not affected.
Not affected if openemr-8.5.0-or-later
Who cares healthcare, openemr, php, self-hosted
8.5.0 or later is not affected.library/ajax/user_settings.php for missing authorization checks on global settings.8.5.0 or later.OpenEMR before 8.5.0 contains a missing authorization vulnerability in library/ajax/user_settings.php that lets any authenticated user persist arbitrary global configuration overrides. Attackers can POST global:-prefixed keys to re-point external service hosts like CouchDB, eRx, phiMail, or SMTP to attacker-controlled servers, exfiltrating system credentials and patient PHI.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.