GHSA-8223-v68r-46vmHighCVSS 7.1
OpenEMR before 8.5.0 contains a missing authorization vulnerability in immunizations.php,...
🔗 CVE IDs covered (1)
📋 Description
OpenEMR before 8.5.0 contains a missing authorization vulnerability in immunizations.php, diagnosis_full.php, and billing_process.php that lets low-privileged users bypass ACL checks. Authenticated Front Office users can reuse their session CSRF token to add or delete immunizations, write encounter billing codes, and invoke the billing processor.
🔗 References (4)
- https://github.com/openemr/openemr/security/advisories/GHSA-xp7w-8fx3-642x
- https://nvd.nist.gov/vuln/detail/CVE-2026-126449
- https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-immunizations-php-diagnosis-full-php-billing-process-php
- https://github.com/advisories/GHSA-8223-v68r-46vm