CVE-2026-126439: OpenEMR before 8.5.0 Authorization Bypass via C-CDA Gateway ccda_gateway.php
OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccdagateway.php that fails to enforce the patients/patrep permission, accepting any authenticated core session. Authenticated users without patient-report permission can request the reportccdview action to retrieve the selected patient's C-CDA clinical summary, including diagnoses, medications, laboratory results, and identifiers.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any user with an authenticated OpenEMR core session may exploit it, including users who do not have the patients/pat_rep permission. The issue does not require user interaction, but exploitation has high attack complexity.
What information could be exposed?
An attacker can use the report_ccd_view action to retrieve the selected patient's C-CDA clinical summary. The exposed data can include diagnoses, medications, laboratory results, and patient identifiers.
Which versions require remediation?
OpenEMR versions before 8.5.0 are affected. Upgrade to version 8.5.0 or later to obtain the authorization enforcement described by the advisory.