CVE-2026-126486: OpenEMR before 8.5.0 Missing Authorization via portal/import_template.php

Q: Who can exploit this issue?

Any authenticated OpenEMR staff user can exploit the affected portal document template modes. The issue does not require administrator or forms ACL privileges for the unguarded actions described.

Q: What could an authenticated staff user do?

A staff user can use mode=save_profiles to delete all template profile assignments. Other unguarded modes can push templates to patients, change template categories, or read template bodies through mode=get or mode=getPdf.

Q: Which versions are affected?

OpenEMR versions before 8.5.0 are affected.

Q: Are CSRF protections present for the affected actions?

The affected portal/import_template.php modes lack CSRF checks, along with the required admin/forms ACL checks.

Published Nov 13, 2026

Updated

OpenEMR before 8.5.0 contains a missing authorization vulnerability in portal/importtemplate.php, where several portal document template modes lack admin/forms ACL and CSRF checks. Any authenticated staff user can send mode=saveprofiles to delete all template profile assignments, use other unguarded modes to push templates to patients or change categories, and read template bodies via mode=get or getPdf.

Affected Software

2 affected components

OpenEMR OpenEMR<8.5.0

open-emr Openemr<8.5.0

Event History

Nov 13, 2026

CVE Published

via MITRE·09:34 AM

Data Sourced

via MITRE·09:34 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who can exploit this issue?

Any authenticated OpenEMR staff user can exploit the affected portal document template modes. The issue does not require administrator or forms ACL privileges for the unguarded actions described.

What could an authenticated staff user do?

A staff user can use mode=save_profiles to delete all template profile assignments. Other unguarded modes can push templates to patients, change template categories, or read template bodies through mode=get or mode=getPdf.

Which versions are affected?

OpenEMR versions before 8.5.0 are affected.

Are CSRF protections present for the affected actions?

The affected portal/import_template.php modes lack CSRF checks, along with the required admin/forms ACL checks.

CVE-2026-126486: OpenEMR before 8.5.0 Missing Authorization via portal/import_template.php

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What could an authenticated staff user do?

Which versions are affected?

Are CSRF protections present for the affected actions?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What could an authenticated staff user do?

Which versions are affected?

Are CSRF protections present for the affected actions?