CVE-2026-126466: OpenEMR before 8.5.0 Missing Authorization in Patient Create and Search Endpoints
OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated user to create patient records and enumerate patients by omitting aclCheckCore() checks. Attackers can POST to newcomprehensivesave.php to create patients with insurance PHI, or query newsearchpopup.php and patientselect.php to leak names, SSNs and DOBs.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated OpenEMR user can exploit it. The attacker does not need elevated privileges, user interaction, or a complex attack path.
What data and actions are exposed?
An attacker can create patient records, including records containing insurance PHI, through new_comprehensive_save.php. They can also enumerate patients and disclose names, Social Security numbers, and dates of birth through new_search_popup.php and patient_select.php.
Which deployments are affected?
OpenEMR versions before 8.5.0 are affected. Because the vulnerable endpoints lack aclCheckCore() authorization checks, authenticated users may be able to access them regardless of intended ACL restrictions.