CVE-2026-32126 Missing authorization in openemr

High 7.1 Published 11 Mar 2026 Updated 12 Mar 2026

Any authenticated user can modify or delete clinical rules and plans due to an inverted ACL check, bypassing administrator restrictions.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-32126?

CVE-2026-32126 is a high-severity missing authorization vulnerability in Open-Emr Openemr, published on 11 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, an inverted boolean condition in ControllerRouter::route() causes the admin/super ACL check to be enforced only for controllers that already have their own internal authorization (review, log), while leaving all other CDR controllers — alerts, ajax, edit, add, detail, browse — accessible to any authenticated user. This allows any logged-in user to suppress clinical decision support alerts system-wide, delete or modify clinical plans, and edit rule configurations — all operations intended to require administrator privileges. This vulnerability is fixed in 8.0.0.1.

Weakness: CWE-862

Which versions are affected by CVE-2026-32126?

It affects 1 product.

Products include Open-Emr Openemr.

How do I fix CVE-2026-32126?

No fix has been published for CVE-2026-32126 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-32126 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32126 exists.

All Open-Emr Openemr vulnerabilities

Sources

Also known as GHSA-752v-x6m4-6cf8.