CVE-2026-126474 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 has a reflected cross-site scripting flaw in its ACL module, triggered through the module_id parameter on acl/index and acl/acl links. An attacker who gets a logged-in user to open a crafted link can run JavaScript in that session, steal non-HttpOnly session cookies and change ACL configuration.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any OpenEMR installation before 8.5.0 where staff log in and can be sent crafted links. Exposure depends on users clicking links while authenticated; instances with no logged-in users exposed to outside links face lower risk. Administrators running OpenEMR 8.5.0 or later are not affected.
Not affected if version-8.5.0-or-later
Who cares healthcare, openemr, self-hosted
version.php and compare it with 8.5.0.8.5.0: move to 8.5.0 or later, per the NVD description.OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the ACL module that allows attackers to execute JavaScript in authenticated sessions via the module_id parameter. Attackers can deliver crafted acl/index or acl/acl links that inject unencoded input into inline script blocks, stealing non-HttpOnly session cookies and modifying ACL configuration.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.