CVE-2026-126461: OpenEMR before 8.5.0 Missing Authorization via user_settings.php Global Override
OpenEMR before 8.5.0 contains a missing authorization vulnerability in library/ajax/usersettings.php that lets any authenticated user persist arbitrary global configuration overrides. Attackers can POST global:-prefixed keys to re-point external service hosts like CouchDB, eRx, phiMail, or SMTP to attacker-controlled servers, exfiltrating system credentials and patient PHI.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMRto a version that resolves this vulnerability.Fixed in 8.5.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated OpenEMR user can exploit it. The attacker does not need to interact with another user, but does need valid account access.
What is required for a successful attack?
The attacker must be able to send POST requests to library/ajax/user_settings.php using global:-prefixed configuration keys. They can use those overrides to direct supported external-service connections to systems they control.
What data or credentials could be exposed?
Redirecting CouchDB, eRx, phiMail, or SMTP hosts to attacker-controlled servers can expose system credentials and patient PHI when OpenEMR connects to those services.
Which versions are affected?
OpenEMR versions before 8.5.0 are affected. The provided information does not identify affected configurations beyond the presence of an authenticated user and reachable external-service settings.