CVE-2026-126449: OpenEMR before 8.5.0 Missing Authorization in immunizations.php, diagnosis_full.php, billing_process.php
OpenEMR before 8.5.0 contains a missing authorization vulnerability in immunizations.php, diagnosisfull.php, and billingprocess.php that lets low-privileged users bypass ACL checks. Authenticated Front Office users can reuse their session CSRF token to add or delete immunizations, write encounter billing codes, and invoke the billing processor.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated OpenEMR user with the low-privileged Front Office role can exploit it. The attack does not require user interaction.
What does an attacker need to perform the unauthorized actions?
The attacker needs an authenticated Front Office session and that session's CSRF token. They can reuse the token to bypass ACL checks in the affected endpoints.
What actions could an affected user perform?
A Front Office user can add or delete immunizations, write encounter billing codes, and invoke the billing processor.
Which versions are affected?
OpenEMR versions before 8.5.0 are affected.