CVE-2026-126442: OpenEMR before 8.5.0 Missing Authorization via create_portallogin.php Portal Takeover
OpenEMR before 8.5.0 contains a missing authorization vulnerability in createportallogin.php that allows low-privilege authenticated users to replace patient portal credentials without ACL checks. Attackers can select a victim patient in session and post replacement credentials to take over portal accounts, read PHI, and lock patients out.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a low-privilege authenticated OpenEMR account. They must be able to select a victim patient in their session and submit replacement portal credentials to create_portallogin.php.
What is the impact of a successful exploit?
The attacker can replace a patient's portal credentials, take over the portal account, read PHI, and lock the patient out of the portal.
Which versions are affected?
OpenEMR versions before 8.5.0 are affected. The provided information indicates that 8.5.0 is the version boundary for this issue.