CVE-2026-126487: open-emr openemr

CVSS 8.8 (high) · published 2026-11-13

OpenEMR before 8.5.0 contains an authorization bypass vulnerability that allows authenticated users to override system-wide global configuration values by storing global-prefixed keys through library/ajax/user_settings.php. Attackers can submit lab or target parameters with global: prefixed setting names to disable audit logging, weaken password policies, or alter security-sensitive settings persistently for their sessions.

Affected products (NVD): open-emr openemr

Fixed in (NVD): 8.5.0

Weakness: CWE-269

Source: NVD CVE-2026-126487

References

• https://github.com/openemr/openemr/security/advisories/GHSA-v997-jphq-wvvr
• https://www.vulncheck.com/advisories/openemr-before-8.5.0-global-configuration-override-via-user-settings-php

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.