CVE-2026-126444: OpenEMR before 8.5.0 Missing Authorization in Ensora eRx via eRx.php
OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Ensora eRx integration that allows authenticated staff without patients/rx permission to access prescription data by directly requesting eRx.php. Attackers can expose selected patients' demographic, medication, and allergy data in the vendor XML and trigger eRx synchronization state changes.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated OpenEMR staff user who does not have patients/rx permission can exploit it. The attacker must be able to directly request the eRx.php endpoint.
What information and actions are exposed?
An attacker can expose selected patients' demographic, medication, and allergy data contained in vendor XML. They can also trigger eRx synchronization state changes.
Are deployments using the Ensora eRx integration affected by default?
The issue is in the Ensora eRx integration and affects OpenEMR versions before 8.5.0. The provided information does not state whether the integration is enabled by default.