CVE-2026-126444
MEDIUM
NVD
CVSS Score
5.9
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Ensora eRx integration that allows authenticated staff without patients/rx permission to access prescription data by directly requesting eRx.php. Attackers can expose selected patients' demographic, medication, and allergy data in the vendor XML and trigger eRx synchronization state changes.