CVE-2026-115573: OpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumeration

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/classes/Controller.class.php allows explicit controller.php dispatch to controllers missing from CONTROLLERACLMAP, and checkControllerAcl() returns without enforcing any permission for those entries. A low-privilege authenticated user can invoke CX12Partner::editactionprocess() to create or alter insurance-routing hosts and credentials, or invoke CPatientFinder::findactionprocess() to enumerate patient names, dates of birth, and identifiers. The shared fail-open dispatcher root cause also exposes other administrative controllers that were intended to be reached through ACL-gated Practice Settings routes. This issue is fixed in version 8.3.0.