OPENEMR · CVE-2026-126487 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 lets any authenticated user save keys with a global: prefix through the user settings endpoint, which overrides system-wide configuration. An attacker can turn off audit logging, weaken password policies, or change security settings that persist for their sessions.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any OpenEMR installation before 8.5.0 where users have login accounts is exposed, because the flaw is reached through the normal user settings request. Clinics and hospitals that self-host OpenEMR should check their version; hosted deployments depend on the vendor's patching.
Who cares healthcare, openemr, php, self-hosted
8.5.0 is affected.8.5.0 or later.OpenEMR before 8.5.0 contains an authorization bypass vulnerability that allows authenticated users to override system-wide global configuration values by storing global-prefixed keys through library/ajax/user_settings.php. Attackers can submit lab or target parameters with global: prefixed setting names to disable audit logging, weaken password policies, or alter security-sensitive settings persistently for their sessions.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.