CVE-2026-126469: OpenEMR before 8.5.0 Missing Authorization in custom/ Export and Chart-Tracker Scripts
OpenEMR before 8.5.0 contains a missing authorization vulnerability in several custom/ scripts that rely only on session authentication and never call AclMain::aclCheckCore(). Any authenticated low-privilege user can request exportlabworks.php, charttracker.php, or exportregistryxml.php to disclose patient SSN, DOB, and insurance data or provider NPI/tax IDs, and forge chart-tracker records.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated OpenEMR user with low privileges can exploit the affected scripts. No user interaction is required.
Which data and functions are exposed?
The affected export scripts can disclose patient SSNs, dates of birth, and insurance data, as well as provider NPI and tax IDs. The chart-tracker script can be used to forge chart-tracker records.
Which endpoints should be reviewed for exposure?
Review access to custom/export_labworks.php, custom/chart_tracker.php, and custom/export_registry_xml.php. These scripts rely on session authentication without performing the required core ACL authorization check.
What versions are affected?
OpenEMR versions before 8.5.0 are affected. Upgrading to 8.5.0 or later addresses the stated affected-version range.