CVE-2026-126468

Published 13 November 2026 · tracked since 14 November 2026

Description

OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated low-privilege user to access reports, dated reminders, and batch reminder endpoints lacking AclMain::aclCheckCore() checks. Attackers can request patient_list.php, amc_full_report.php, dated_reminders_a

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-126477 MEDIUM 4.8
• CVE-2026-126472 HIGH 8.8
• CVE-2026-126471 MEDIUM 6.5
• CVE-2026-126469 HIGH 8.8
• CVE-2026-126466 HIGH 8.8
• CVE-2026-126465 MEDIUM 6.5
• CVE-2026-126462 MEDIUM 5.4
• CVE-2026-126461 MEDIUM 6.5
• CVE-2026-126460 HIGH 7.1
• CVE-2026-126458 HIGH 8.8

→ Open the live CVE board · all tools