CVE-2026-126479 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 has five Module Manager actions that skip the admin module-management permission check and CSRF validation. A low-privilege account such as Front Office can overwrite module configuration, redirect CCDA and HIE settings, and delete module hooks.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any OpenEMR deployment earlier than 8.5.0 is exposed, since the flaw sits in the Module Manager controller that ships with it. Exposure requires an authenticated account, so deployments where only trusted clinical staff hold logins carry less risk, though low-privilege roles such as Front Office can reach the actions.
Not affected if auth-required, openemr-8.5.0-or-later
Who cares healthcare, openemr, self-hosted
8.5.0.8.5.0 or later (per the NVD range before 8.5.0).OpenEMR before 8.5.0 contains a missing authorization vulnerability in five Module Manager InstallerController actions that lack the admin/manage_modules ACL check and CSRF validation. Low-privilege users such as Front Office accounts can POST to saveConfig or SaveHooks to overwrite any module's configuration, retarget CCDA and HIE settings, and delete module hooks.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.