CVE-2026-126437OpenEMR before 8.5.0 Authorization Bypass via portal/lib/download_template.php

Açıklama

OpenEMR before 8.5.0 contains an authorization bypass vulnerability in portal/lib/download_template.php that allows any authenticated core user to render documents for arbitrary patients by setting isModule. Attackers can submit arbitrary pid and template_id values to disclose patient names, birth dates, chart IDs, addresses, allergies, medications, and problem lists despite ACL and squad restrictions.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-vc2h-x8xf-8jcv) vendor-advisory
• VulnCheck Advisory: OpenEMR before 8.5.0 Authorization Bypass via portal/lib/download_template.php third-party-advisory