CVE-2026-126487: OpenEMR before 8.5.0 Global Configuration Override via user_settings.php
OpenEMR before 8.5.0 contains an authorization bypass vulnerability that allows authenticated users to override system-wide global configuration values by storing global-prefixed keys through library/ajax/usersettings.php. Attackers can submit lab or target parameters with global: prefixed setting names to disable audit logging, weaken password policies, or alter security-sensitive settings persistently for their sessions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMRto a version that resolves this vulnerability.Fixed in 8.5.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated OpenEMR user can exploit it. The attack does not require user interaction and can be performed remotely over the network.
What access or request capability does an attacker need?
The attacker needs valid authentication and the ability to submit lab or target parameters to library/ajax/user_settings.php. They use setting names prefixed with "global:" to write system-wide configuration values.
Are default deployments affected?
The provided information identifies affected versions as OpenEMR releases before 8.5.0. It does not state that any particular default configuration prevents exploitation.
What can be changed through exploitation?
An attacker can persistently alter security-sensitive global settings for their sessions, including disabling audit logging or weakening password policies. The vulnerability can affect confidentiality, integrity, and availability.
How can defenders identify possible exploitation?
Review requests to library/ajax/user_settings.php for lab or target parameters whose setting names begin with "global:". Also investigate unexpected changes to global security settings, such as audit logging or password-policy configuration.