CVE-2026-126479
HIGH
NVD
CVSS Score
7.6
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
OpenEMR before 8.5.0 contains a missing authorization vulnerability in five Module Manager InstallerController actions that lack the admin/manage_modules ACL check and CSRF validation. Low-privilege users such as Front Office accounts can POST to saveConfig or SaveHooks to overwrite any module's configuration, retarget CCDA and HIE settings, and delete module hooks.