CVE-2026-126469

CVSS 8.8 (high) · published 2026-11-13

OpenEMR before 8.5.0 contains a missing authorization vulnerability in several custom/ scripts that rely only on session authentication and never call AclMain::aclCheckCore(). Any authenticated low-privilege user can request export_labworks.php, chart_tracker.php, or export_registry_xml.php to disclose patient SSN, DOB, and insurance data or provider NPI/tax IDs, and forge chart-tracker records.

Weakness: CWE-862

Source: NVD CVE-2026-126469

References

• https://github.com/openemr/openemr/security/advisories/GHSA-3h5w-672p-v4m9
• https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-custom-export-and-chart-tracker-scripts
• https://github.com/openemr/openemr/security/advisories/GHSA-3h5w-672p-v4m9

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.