CVE-2026-126442

Published 13 November 2026 · tracked since 14 November 2026

Description

OpenEMR before 8.5.0 contains a missing authorization vulnerability in create_portallogin.php that allows low-privilege authenticated users to replace patient portal credentials without ACL checks. Attackers can select a victim patient in session and post replacement credentials to take over portal

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-129444 CRITICAL 10
• CVE-2026-129443 MEDIUM 6.3
• CVE-2026-127048
• CVE-2026-124673
• CVE-2026-124671
• CVE-2026-123707
• CVE-2026-116559
• CVE-2026-114452
• CVE-2026-114451
• CVE-2026-110989

→ Open the live CVE board · all tools