CVE-2026-126440: OpenEMR before 8.5.0 Document ACL Bypass via Care Coordination Import
OpenEMR before 8.5.0 contains a missing authorization flaw in the Care Coordination CCDA and CCR import controllers, which move a document named by the documentid parameter into the import category without checking access to the source document. Authenticated non-administrators with Care Coordination access can recategorize protected patient documents and then download them through normal ACL-checked retrieval.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated non-administrator needs Care Coordination access. The attacker also needs to be able to submit an import request referencing the target document's document_id.
Are systems affected if Care Coordination access is not granted to non-administrators?
The described attack requires a non-administrator with Care Coordination access. The provided information does not indicate that users without that access can use the vulnerable import controllers.
What is the impact of a successful exploit?
An attacker can move a protected patient document into the import category and then download it through normal ACL-checked retrieval. This can expose document contents and alter the document's categorization.
What should be prioritized if an update cannot be applied immediately?
Restrict Care Coordination access for non-administrative accounts, especially accounts that do not need CCDA or CCR import functionality. This reduces access to the vulnerable import controllers described.
How can administrators identify potentially affected deployments?
Deployments running OpenEMR before 8.5.0 are affected according to the advisory. Review which non-administrative users have Care Coordination access, since those accounts meet the stated privilege requirement.