What’s Vulnerable › Vulnerabilities
CVE-2026-32126: OpenEMR: Inverted ACL Condition in CDR ControllerRouter Allows Any Authenticated User to Modify/Delete Clinical Rules and Plans
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-03-11 · updated 2026-06-17
- Weakness: CWE-862
Description
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, an inverted boolean condition in ControllerRouter::route() causes the admin/super ACL check to be enforced only for controllers that already have their own internal authorization (review, log), while leaving all other CDR controllers — alerts, ajax, edit, add, detail, browse — accessible to any authenticated user. This allows any logged-in user to suppress clinical decision support alerts system-wide, delete or modify clinical plans, and edit rule configurations — all operations intended to require administrator privileges. This vulnerability is fixed in 8.0.0.1.
Affected products
- openemr: before 8.0.0.1 — fixed in 8.0.0.1
How to fix
Upgrade to a fixed version: openemr 8.0.0.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-32126 or the next vulnerability affects your stack