Openemr
CVE-2026-126440: OpenEMR before 8.5.0 contains a missing authorization flaw in the Care Coordination CCDA and CCR import controllers, which move a document named by the document
CVE-2026-126440 Nov 13, 2026 Source: Vendor
In brief. Openemr published CVE-2026-126440: OpenEMR before 8.5.0 contains a missing authorization flaw in the Care Coordination CCDA and CCR import controllers, which move a document named by the document on November 13, 2026. It credits 1 researcher or team for 1 CVE.
OpenEMR before 8.5.0 contains a missing authorization flaw in the Care Coordination CCDA and CCR import controllers, which move a document named by the document_id parameter into the import category without checking access to the source document. Authenticated non-administrators with Care Coordination access can recategorize protected patient documents and then download them through normal ACL-checked retrieval.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-126440
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
1 line
Showing 1–1 of 1 matching , clear filters