CVE-2026-126457
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
OpenEMR before 8.5.0 contains a missing authorization vulnerability in InstallerController that allows any authenticated user to modify module administration settings without the admin/manage_modules permission. Low-privileged users such as Front Office clerks can POST to saveConfig, DeleteAcl, DeleteHooks and nickName actions to reconfigure or partially disable installed modules.