CVE-2026-126474: OpenEMR before 8.5.0 Reflected XSS via ACL Module module_id Parameter

Q: Which OpenEMR deployments are affected?

OpenEMR versions before 8.5.0 are affected. Upgrading to 8.5.0 or later addresses the affected version range.

Q: What does an attacker need to exploit this issue?

An attacker does not need prior privileges, but must induce a user with an authenticated OpenEMR session to follow a crafted ACL link. The affected request paths include acl/index and acl/acl, using the module_id parameter.

Q: What could happen if the vulnerability is exploited?

Injected JavaScript can run in the authenticated user's browser session. It may steal session cookies that are not marked HttpOnly and modify ACL configuration.

Published Nov 13, 2026

Updated

OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the ACL module that allows attackers to execute JavaScript in authenticated sessions via the moduleid parameter. Attackers can deliver crafted acl/index or acl/acl links that inject unencoded input into inline script blocks, stealing non-HttpOnly session cookies and modifying ACL configuration.

Affected Software

1 affected component

OpenEMR OpenEMR<8.5.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenEMR to a version that resolves this vulnerability.
Fixed in 8.5.0

Event History

Nov 13, 2026

CVE Published

via MITRE·09:34 AM

Data Sourced

via MITRE·09:34 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which OpenEMR deployments are affected?

OpenEMR versions before 8.5.0 are affected. Upgrading to 8.5.0 or later addresses the affected version range.

What does an attacker need to exploit this issue?

An attacker does not need prior privileges, but must induce a user with an authenticated OpenEMR session to follow a crafted ACL link. The affected request paths include acl/index and acl/acl, using the module_id parameter.

What could happen if the vulnerability is exploited?

Injected JavaScript can run in the authenticated user's browser session. It may steal session cookies that are not marked HttpOnly and modify ACL configuration.

CVE-2026-126474: OpenEMR before 8.5.0 Reflected XSS via ACL Module module_id Parameter

Affected Software

Remediation

Event History

Frequently Asked Questions

Which OpenEMR deployments are affected?

What does an attacker need to exploit this issue?

What could happen if the vulnerability is exploited?

Company

Resources

Contact

Frequently Asked Questions

Which OpenEMR deployments are affected?

What does an attacker need to exploit this issue?

What could happen if the vulnerability is exploited?