{"id":"CVE-2026-126486","kind":"vulnerability","aliases":["CVE-2026-126486"],"related":[],"title":"OpenEMR: missing access checks let staff delete and read portal templates","description":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in portal/import_template.php, where several portal document template modes lack admin/forms ACL and CSRF checks. Any authenticated staff user can send mode=save_profiles to delete all template profile assignments, use other unguarded modes to push templates to patients or change categories, and read template bodies via mode=get or getPdf.","summary":"OpenEMR, an electronic health records system, fails to check permissions and CSRF tokens in several portal document template modes of portal/import_template.php. Any logged-in staff user can delete template assignments, push templates to patients, change categories, and read template bodies.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","php","runtime","self-hosted"],"not_affected_if":["portal-unused","version-8.5.0-or-later"],"how_to_check":"- Check the OpenEMR version with the installed `version.php` or the admin footer; versions below `8.5.0` are affected.\n- Confirm whether the portal feature is enabled for patients in the OpenEMR admin settings.","fix":"- OpenEMR: upgrade to `8.5.0` or later (per the advisory).","status":"open","published_at":"2026-11-13T10:17:58+00:00","first_seen_at":"2026-11-13T10:47:26+00:00","triaged_at":"2026-11-13T10:52:36+00:00","updated_at":"2026-11-13T10:52:36+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-13T10:52:36Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: upgrade to `8.5.0` or later (per the advisory).","reach":"network","title":"OpenEMR: missing access checks let staff delete and read portal templates","impact":"medium","summary":"OpenEMR, an electronic health records system, fails to check permissions and CSRF tokens in several portal document template modes of portal/import_template.php. Any logged-in staff user can delete template assignments, push templates to patients, change categories, and read template bodies.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","self-hosted","healthcare","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Staff user deletes template assignments and reads patient-facing document templates","analyst_note":"Check the vendor advisory on github.com and the vulncheck advisory for the exact affected range and any workaround for the portal template modes.","how_to_check":"- Check the OpenEMR version with the installed `version.php` or the admin footer; versions below `8.5.0` are affected.\n- Confirm whether the portal feature is enabled for patients in the OpenEMR admin settings.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-8.5.0-or-later","portal-unused"],"who_is_affected":"Clinics and organizations that run OpenEMR 8.4.x or earlier with the patient portal document templates in use. Any authenticated staff account can exploit it, so any deployment with many staff logins is exposed. Installations already on 8.5.0 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000752,"input_tokens":4624,"output_tokens":580,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126486':14A,17A '-2026':13A,16A '8.5.0':68C 'access':3A 'acl':84C 'admin/forms':83C 'assign':55B,102C 'authent':89C 'author':72C 'bodi':65B,118C 'categori':61B,114C 'chang':60B,113C 'check':4A,33B,87C 'contain':69C 'csrf':36B,86C 'cve':12A,15A 'delet':7A,53B,98C 'document':41B,79C 'electron':27B 'fail':31B 'get':121C 'getpdf':123C 'health':28B 'healthcar':18B 'host':24B 'lack':82C 'let':5A 'log':48B 'logged-in':47B 'miss':2A,71C 'mode':43B,81C,94C,106C,120C 'openemr':1A,19B,25B,66C 'patient':59B,111C 'permiss':34B 'php':20B 'portal':10A,40B,78C 'portal/import_template.php':45B,75C 'profil':96C,101C 'push':56B,108C 'read':9A,63B,116C 'record':29B 'runtim':21B 'save':95C 'self':23B 'self-host':22B 'send':93C 'sever':39B,77C 'staff':6A,50B,90C 'system':30B 'templat':11A,42B,54B,57B,64B,80C,100C,109C,117C 'token':37B 'unguard':105C 'use':103C 'user':51B,91C 'via':119C 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"Clinics and organizations that run OpenEMR 8.4.x or earlier with the patient portal document templates in use. Any authenticated staff account can exploit it, so any deployment with many staff logins is exposed. Installations already on 8.5.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","php","runtime","selfhosted"],"campaign_type":null,"search_a":"'-126486':14A,17A '-2026':13A,16A 'access':3A 'check':4A 'cve':12A,15A 'delet':7A 'let':5A 'miss':2A 'openemr':1A 'portal':10A 'read':9A 'staff':6A 'templat':11A","search_b":"'assign':55B 'bodi':65B 'categori':61B 'chang':60B 'check':33B 'csrf':36B 'delet':53B 'document':41B 'electron':27B 'fail':31B 'health':28B 'healthcar':18B 'host':24B 'log':48B 'logged-in':47B 'mode':43B 'openemr':19B,25B 'patient':59B 'permiss':34B 'php':20B 'portal':40B 'portal/import_template.php':45B 'push':56B 'read':63B 'record':29B 'runtim':21B 'self':23B 'self-host':22B 'sever':39B 'staff':50B 'system':30B 'templat':42B,54B,57B,64B 'token':37B 'user':51B","search_c":"'8.5.0':68C 'acl':84C 'admin/forms':83C 'assign':102C 'authent':89C 'author':72C 'bodi':118C 'categori':114C 'chang':113C 'check':87C 'contain':69C 'csrf':86C 'delet':98C 'document':79C 'get':121C 'getpdf':123C 'lack':82C 'miss':71C 'mode':81C,94C,106C,120C 'openemr':66C 'patient':111C 'portal':78C 'portal/import_template.php':75C 'profil':96C,101C 'push':108C 'read':116C 'save':95C 'send':93C 'sever':77C 'staff':90C 'templat':80C,100C,109C,117C 'unguard':105C 'use':103C 'user':91C 'via':119C 'vulner':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:18:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126486","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126486","severity":null,"published_at":"2026-11-13T10:17:58+00:00","modified_at":"2026-11-13T10:17:58+00:00","first_seen_at":"2026-11-13T10:47:26+00:00","fetched_at":"2026-11-13T10:47:26+00:00","note":null}],"documents":[{"id":145215,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-phvv-q7m7-8mc2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:18:42+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145216,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-portal-import-template-php","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}