CVE-2026-126457: OpenEMR before 8.5.0 Missing Authorization in InstallerController Module Actions
OpenEMR before 8.5.0 contains a missing authorization vulnerability in InstallerController that allows any authenticated user to modify module administration settings without the admin/managemodules permission. Low-privileged users such as Front Office clerks can POST to saveConfig, DeleteAcl, DeleteHooks and nickName actions to reconfigure or partially disable installed modules.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.5.0
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated OpenEMR user can exploit it without the admin/manage_modules permission. This includes low-privileged accounts such as Front Office clerks.
What access and interaction are required for exploitation?
An attacker needs valid authenticated access to OpenEMR and can send POST requests to the affected InstallerController actions. No user interaction is required.
Which module administration functions can be affected?
The affected actions are saveConfig, DeleteAcl, DeleteHooks, and nickName. They can be used to reconfigure installed modules or partially disable them.
How can I determine whether my deployment is affected?
Deployments running OpenEMR before version 8.5.0 are affected. A practical validation is whether a non-administrative authenticated account can successfully POST to the listed InstallerController actions without having the admin/manage_modules permission.