CVE-2026-115573
Description
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/classes/Controller.class.php allows explicit controller.php dispatch to controllers missing from CONTROLLER_ACL_MAP, and checkControllerAcl() returns without enforcing any permission for those entries. A low-privilege authenticated user can invoke C_X12Partner::edit_action_process() to create or alter insurance-routing hosts and credentials, or invoke C_PatientFinder::find_action_process() to enumerate patient names, dates of birth, and identifiers. The shared fail-open dispatcher root cause also exposes other administrative controllers that were intended to be reached through ACL-gated Practice Settings routes. This issue is fixed in version 8.3.0.
References
- https://github.com/openemr/openemr/commit/64f8491d850b2e22ed4fceb14fa67e27fef62cd1
- https://github.com/openemr/openemr/pull/13565
- https://github.com/openemr/openemr/releases/tag/v8_3_0
- https://github.com/openemr/openemr/security/advisories/GHSA-9rj4-fxmj-c4r7
- https://github.com/openemr/openemr/security/advisories/GHSA-9rj4-fxmj-c4r7