CVE-2026-126468 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 lets any logged-in user with low privileges open report, reminder and batch reminder endpoints that skip access checks. An attacker can export patient health information and trigger unauthorized reminders.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any OpenEMR instance before 8.5.0 where users hold authenticated low-privilege accounts is exposed, since the flawed endpoints lack the ACL check that the rest of the application applies. Instances that are upgraded to 8.5.0 or later, or where only fully trusted staff have accounts, are less exposed. Sources do not state configuration details beyond the version.
Not affected if version-8.5.0-or-later
Who cares healthcare, openemr, phi, self-hosted
8.5.0).8.5.0OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated low-privilege user to access reports, dated reminders, and batch reminder endpoints lacking AclMain::aclCheckCore() checks. Attackers can request patient_list.php, amc_full_report.php, dated_reminders_add.php, or batch_reminders.php directly to export patient PHI, send unauthorized reminders, and trigger batch reminder processing.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.