CVE-2026-126479: OpenEMR before 8.5.0 Missing Authorization in Module Manager Installer Actions
OpenEMR before 8.5.0 contains a missing authorization vulnerability in five Module Manager InstallerController actions that lack the admin/managemodules ACL check and CSRF validation. Low-privilege users such as Front Office accounts can POST to saveConfig or SaveHooks to overwrite any module's configuration, retarget CCDA and HIE settings, and delete module hooks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMRto a version that resolves this vulnerability.Fixed in 8.5.0
Event History
Frequently Asked Questions
What level of access does an attacker need?
An attacker needs an authenticated low-privilege OpenEMR account, such as a Front Office account. No user interaction is required, and the affected actions can be reached with POST requests.
What could a successful attacker change?
They can overwrite configuration for any module, retarget CCDA and HIE settings, and delete module hooks. The affected functionality lacks both the admin/manage_modules authorization check and CSRF validation.
How can I determine whether my deployment is affected?
Deployments running an OpenEMR version before 8.5.0 are affected. Review whether low-privilege accounts can submit POST requests to the Module Manager InstallerController saveConfig or SaveHooks actions.