CVE-2026-126419

Published 13 November 2026 · tracked since 14 November 2026

Description

OpenEMR before 8.5.0 contains a missing authorization vulnerability in the esign_form_submit handler of library/ESign/Form/Controller.php that verifies only the caller's password, not access to the patient, encounter, or form type. Authenticated core users can supply arbitrary formId, formDir, and e

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-129444 CRITICAL 10
• CVE-2026-129443 MEDIUM 6.3
• CVE-2026-127048
• CVE-2026-124673
• CVE-2026-124671
• CVE-2026-123707
• CVE-2026-116559
• CVE-2026-114452
• CVE-2026-114451
• CVE-2026-110989

→ Open the live CVE board · all tools