CVE-2026-126437: OpenEMR before 8.5.0 Authorization Bypass via portal/lib/download_template.php
OpenEMR before 8.5.0 contains an authorization bypass vulnerability in portal/lib/downloadtemplate.php that allows any authenticated core user to render documents for arbitrary patients by setting isModule. Attackers can submit arbitrary pid and templateid values to disclose patient names, birth dates, chart IDs, addresses, allergies, medications, and problem lists despite ACL and squad restrictions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMRto a version that resolves this vulnerability.Fixed in 8.5.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated OpenEMR core user can exploit it. The flaw bypasses ACL and squad restrictions, so the user does not need authorization for the targeted patient's records.
What does an attacker need to provide to access another patient's information?
The attacker can submit arbitrary pid and template_id values while setting isModule. This can cause documents to be rendered for patients outside the attacker's permitted scope.
What information could be disclosed?
Exposed information includes patient names, birth dates, chart IDs, addresses, allergies, medications, and problem lists.
Which versions are affected?
OpenEMR versions before 8.5.0 are affected. Upgrading to 8.5.0 or later addresses the affected version range described in the advisory.