CVE-2026-126448: OpenEMR before 8.5.0 Missing Authorization in Nation Notes Configuration Handlers
OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows authenticated users lacking nationnotes/nnconfigure to modify shared Nation Notes templates by calling mutation endpoints directly. Attackers can send requests to ajaxcode.php or addcontext.php, which lack ACL and CSRF checks, to tamper with clinical-note templates and assignments.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.5.0
Event History
Frequently Asked Questions
Does exploitation require an authenticated account?
Yes. An attacker needs an authenticated OpenEMR account, but does not need the nationnotes/nn_configure permission because the affected mutation endpoints do not enforce the required ACL checks.
What can an unauthorized user change?
They can modify shared Nation Notes templates and their assignments by directly calling the affected mutation endpoints. The documented impact is unauthorized modification rather than disclosure or service disruption.
How can I determine whether an installation is affected?
Installations running a version before 8.5.0 are affected. The relevant endpoints are ajax_code.php and add_context.php.