CVE-2026-126458: OpenEMR before 8.5.0 Missing Authorization via authorizations_full.php

Q: Who can exploit this issue?

Any authenticated OpenEMR staff user can exploit it. The attacker does not need provider-review privileges, but does need a valid CSRF token associated with their own authenticated session.

Q: What records can be improperly authorized?

An attacker can set authorized=1 for an attacker-chosen patient ID on billing, forms, pnotes, and transaction records. This can bypass the intended provider review process for those records.

Q: Are unauthenticated internet users able to exploit it directly?

No. The described exploit requires an authenticated staff account and that user's CSRF token; the available information does not indicate unauthenticated exploitation.

Q: Which versions are affected?

OpenEMR versions before 8.5.0 are affected. The provided information identifies 8.5.0 as the version boundary but does not provide further patch or backport details.

Published Nov 13, 2026

Updated

OpenEMR before 8.5.0 contains a missing authorization vulnerability in authorizationsfull.php that allows any authenticated staff user to authorize arbitrary patients' clinical records. Attackers can send a mode=authorize request with an attacker-chosen pid and their own CSRF token to set authorized=1 on billing, forms, pnotes, and transactions records, bypassing provider review.

Affected Software

1 affected component

OpenEMR OpenEMR<8.5.0

Event History

Nov 13, 2026

CVE Published

via MITRE·09:35 AM

Data Sourced

via MITRE·09:35 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated OpenEMR staff user can exploit it. The attacker does not need provider-review privileges, but does need a valid CSRF token associated with their own authenticated session.

What records can be improperly authorized?

An attacker can set authorized=1 for an attacker-chosen patient ID on billing, forms, pnotes, and transaction records. This can bypass the intended provider review process for those records.

Are unauthenticated internet users able to exploit it directly?

No. The described exploit requires an authenticated staff account and that user's CSRF token; the available information does not indicate unauthenticated exploitation.

Which versions are affected?

OpenEMR versions before 8.5.0 are affected. The provided information identifies 8.5.0 as the version boundary but does not provide further patch or backport details.

CVE-2026-126458: OpenEMR before 8.5.0 Missing Authorization via authorizations_full.php

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What records can be improperly authorized?

Are unauthenticated internet users able to exploit it directly?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What records can be improperly authorized?

Are unauthenticated internet users able to exploit it directly?

Which versions are affected?