{"id":"CVE-2026-126479","kind":"vulnerability","aliases":["CVE-2026-126479"],"related":[],"title":"OpenEMR: missing access checks let low-privilege users change module settings","description":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in five Module Manager InstallerController actions that lack the admin/manage_modules ACL check and CSRF validation. Low-privilege users such as Front Office accounts can POST to saveConfig or SaveHooks to overwrite any module's configuration, retarget CCDA and HIE settings, and delete module hooks.","summary":"OpenEMR before 8.5.0 has five Module Manager actions that skip the admin module-management permission check and CSRF validation. A low-privilege account such as Front Office can overwrite module configuration, redirect CCDA and HIE settings, and delete module hooks.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","runtime","self-hosted"],"not_affected_if":["auth-required","openemr-8.5.0-or-later"],"how_to_check":"- Find the installed OpenEMR version in the application's version file or admin footer and compare it with `8.5.0`.\n- Check whether the Module Manager (InstallerController) is reachable by non-admin roles.","fix":"- OpenEMR: move to `8.5.0` or later (per the NVD range before 8.5.0).","status":"open","published_at":"2026-11-13T10:17:57+00:00","first_seen_at":"2026-11-13T10:47:25+00:00","triaged_at":"2026-11-13T10:52:37+00:00","updated_at":"2026-11-13T10:52:37+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-13T10:52:37Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.5.0` or later (per the NVD range before 8.5.0).","reach":"network","title":"OpenEMR: missing access checks let low-privilege users change module settings","impact":"medium","summary":"OpenEMR before 8.5.0 has five Module Manager actions that skip the admin module-management permission check and CSRF validation. A low-privilege account such as Front Office can overwrite module configuration, redirect CCDA and HIE settings, and delete module hooks.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","healthcare","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated low-privilege users alter module configuration and hooks.","analyst_note":"Product ranges were not supplied; confirm the fixed version against the vendor advisory on github.com.\n","how_to_check":"- Find the installed OpenEMR version in the application's version file or admin footer and compare it with `8.5.0`.\n- Check whether the Module Manager (InstallerController) is reachable by non-admin roles.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["openemr-8.5.0-or-later","auth-required"],"who_is_affected":"Any OpenEMR deployment earlier than 8.5.0 is exposed, since the flaw sits in the Module Manager controller that ships with it. Exposure requires an authenticated account, so deployments where only trusted clinical staff hold logins carry less risk, though low-privilege roles such as Front Office can reach the actions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000759,"input_tokens":4625,"output_tokens":594,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126479':15A,18A '-2026':14A,17A '8.5.0':27B,69C 'access':3A 'account':49B,98C 'acl':85C 'action':32B,80C 'admin':36B 'admin/manage_modules':84C 'author':73C 'ccda':59B,112C 'chang':10A 'check':4A,41B,86C 'configur':57B,110C 'contain':70C 'csrf':43B,88C 'cve':13A,16A 'delet':64B,117C 'five':29B,76C 'front':52B,96C 'healthcar':19B 'hie':61B,114C 'hook':66B,119C 'host':24B 'installercontrol':79C 'lack':82C 'let':5A 'low':7A,47B,91C 'low-privileg':6A,46B,90C 'manag':31B,39B,78C 'miss':2A,72C 'modul':11A,30B,38B,56B,65B,77C,108C,118C 'module-manag':37B 'offic':53B,97C 'openemr':1A,20B,25B,67C 'overwrit':55B,106C 'permiss':40B 'post':100C 'privileg':8A,48B,92C 'redirect':58B 'retarget':111C 'runtim':21B 'saveconfig':102C 'savehook':104C 'self':23B 'self-host':22B 'set':12A,62B,115C 'skip':34B 'user':9A,93C 'valid':44B,89C 'vulner':74C","nicknames":[],"mitigations":[],"who_affected":"Any OpenEMR deployment earlier than 8.5.0 is exposed, since the flaw sits in the Module Manager controller that ships with it. Exposure requires an authenticated account, so deployments where only trusted clinical staff hold logins carry less risk, though low-privilege roles such as Front Office can reach the actions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","runtime","selfhosted"],"campaign_type":null,"search_a":"'-126479':15A,18A '-2026':14A,17A 'access':3A 'chang':10A 'check':4A 'cve':13A,16A 'let':5A 'low':7A 'low-privileg':6A 'miss':2A 'modul':11A 'openemr':1A 'privileg':8A 'set':12A 'user':9A","search_b":"'8.5.0':27B 'account':49B 'action':32B 'admin':36B 'ccda':59B 'check':41B 'configur':57B 'csrf':43B 'delet':64B 'five':29B 'front':52B 'healthcar':19B 'hie':61B 'hook':66B 'host':24B 'low':47B 'low-privileg':46B 'manag':31B,39B 'modul':30B,38B,56B,65B 'module-manag':37B 'offic':53B 'openemr':20B,25B 'overwrit':55B 'permiss':40B 'privileg':48B 'redirect':58B 'runtim':21B 'self':23B 'self-host':22B 'set':62B 'skip':34B 'valid':44B","search_c":"'8.5.0':69C 'account':98C 'acl':85C 'action':80C 'admin/manage_modules':84C 'author':73C 'ccda':112C 'check':86C 'configur':110C 'contain':70C 'csrf':88C 'delet':117C 'five':76C 'front':96C 'hie':114C 'hook':119C 'installercontrol':79C 'lack':82C 'low':91C 'low-privileg':90C 'manag':78C 'miss':72C 'modul':77C,108C,118C 'offic':97C 'openemr':67C 'overwrit':106C 'post':100C 'privileg':92C 'retarget':111C 'saveconfig':102C 'savehook':104C 'set':115C 'user':93C 'valid':89C 'vulner':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:18:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126479","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126479","severity":null,"published_at":"2026-11-13T10:17:57+00:00","modified_at":"2026-11-13T10:17:57+00:00","first_seen_at":"2026-11-13T10:47:25+00:00","fetched_at":"2026-11-13T10:47:25+00:00","note":null}],"documents":[{"id":145201,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-gpcx-xcp2-2rhx","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:18:21+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145202,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-module-manager-installer-actions","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}