CVE-2026-126468: OpenEMR before 8.5.0 Missing Authorization on Reports and Reminder Endpoints
OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated low-privilege user to access reports, dated reminders, and batch reminder endpoints lacking AclMain::aclCheckCore() checks. Attackers can request patientlist.php, amcfullreport.php, datedremindersadd.php, or batchreminders.php directly to export patient PHI, send unauthorized reminders, and trigger batch reminder processing.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated OpenEMR user with low privileges can exploit the affected endpoints. No user interaction is required.
What access does an attacker need?
The attacker needs valid authenticated access to OpenEMR, but does not need elevated report or reminder permissions because the affected endpoints lack the required authorization checks.
Which functions are exposed?
The affected endpoints are patient_list.php, amc_full_report.php, dated_reminders_add.php, and batch_reminders.php. They can be requested directly to export patient PHI, send reminders without authorization, or trigger batch reminder processing.
Are installations running OpenEMR 8.5.0 affected?
The issue affects OpenEMR versions before 8.5.0. The provided information does not identify any configuration prerequisite beyond having an authenticated low-privilege account.