Access Control Vulnerability in OpenEMR by OpenEMR

CVE-2026-115573

What is CVE-2026-115573?

OpenEMR, an open-source electronic health records and medical practice management application, contains a significant access control issue in versions prior to 8.3.0. This flaw allows low-privilege authenticated users to bypass critical permissions and access administrative functions that should be restricted. Specifically, users can manipulate insurance-routing hosts, credentials, and even enumerate sensitive patient information, including names and identifiers. The vulnerability arises from a failure in the permission checking mechanism, enabling unauthorized actions that could compromise patient data integrity.

References