CVE-2026-126486 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR, an electronic health records system, fails to check permissions and CSRF tokens in several portal document template modes of portal/import_template.php. Any logged-in staff user can delete template assignments, push templates to patients, change categories, and read template bodies.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Clinics and organizations that run OpenEMR 8.4.x or earlier with the patient portal document templates in use. Any authenticated staff account can exploit it, so any deployment with many staff logins is exposed. Installations already on 8.5.0 or later are not affected.
Not affected if portal-unused, version-8.5.0-or-later
Who cares healthcare, openemr, php, self-hosted
version.php or the admin footer; versions below 8.5.0 are affected.8.5.0 or later (per the advisory).OpenEMR before 8.5.0 contains a missing authorization vulnerability in portal/import_template.php, where several portal document template modes lack admin/forms ACL and CSRF checks. Any authenticated staff user can send mode=save_profiles to delete all template profile assignments, use other unguarded modes to push templates to patients or change categories, and read template bodies via mode=get or getPdf.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.