CVE-2026-32126
Published: 11 March 2026
Description
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, an inverted boolean condition in ControllerRouter::route() causes the admin/super ACL check to be enforced only for controllers that already have their own…
more
internal authorization (review, log), while leaving all other CDR controllers — alerts, ajax, edit, add, detail, browse — accessible to any authenticated user. This allows any logged-in user to suppress clinical decision support alerts system-wide, delete or modify clinical plans, and edit rule configurations — all operations intended to require administrator privileges. This vulnerability is fixed in 8.0.0.1.
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for access to system resources, directly addressing the bypassed admin/super ACL checks in ControllerRouter::route() for CDR controllers.
Employs least privilege to restrict low-privileged authenticated users from performing administrator-only operations like modifying clinical plans or suppressing alerts.
Requires a tamper-resistant reference monitor mechanism to enforce access control policies without bypass, mitigating the inverted boolean logic flaw in the routing function.
Security SummaryAI
CVE-2026-32126 is a missing authorization vulnerability (CWE-862) affecting OpenEMR, a free and open source electronic health records and medical practice management application. In versions prior to 8.0.0.1, an inverted boolean condition in the ControllerRouter::route() function causes the admin/superuser access control list (ACL) check to be enforced only for controllers that already have their own internal authorization, such as review and log. This leaves other clinical decision rules (CDR) controllers—alerts, ajax, edit, add, detail, and browse—accessible to any authenticated user, bypassing intended administrator privileges.
Any low-privileged authenticated user can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows the attacker to suppress clinical decision support alerts system-wide, delete or modify clinical plans, and edit rule configurations, resulting in high integrity impact and low availability impact as rated by the CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).
The GitHub Security Advisory (GHSA-752v-x6m4-6cf8) confirms the issue and states that it is fixed in OpenEMR version 8.0.0.1, recommending that users upgrade to this patched release to mitigate the vulnerability.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization enables low-privileged authenticated users to exploit the public-facing OpenEMR web application (T1190) for privilege escalation to admin/superuser actions (T1068) such as modifying/deleting clinical plans and editing configurations.