CVE-2026-115573

Dashboard / Vulnerabilities / CVE-2026-115573

CVE-2026-115573

Summary: OpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumeration

Details: OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/classes/Controller.class.php allows explicit controller.php dispatch to controllers missing from CONTROLLER_ACL_MAP, and checkControllerAcl() returns without enforcing any permission for those entries. A low-privilege authenticated user can invoke C_X12Partner::edit_action_process() to create or alter insurance-routing hosts and credentials, or invoke C_PatientFinder::find_action_process() to enumerate patient names, dates of birth, and identifiers. The shared fail-open dispatcher root cause also exposes other administrative controllers that were intended to be reached through ACL-gated Practice Settings routes. This issue is fixed in version 8.3.0.

References: https://github.com/openemr/openemr/releases/tag/v8_3_0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115573.json, https://github.com/openemr/openemr/security/advisories/GHSA-9rj4-fxmj-c4r7, https://nvd.nist.gov/vuln/detail/CVE-2026-115573, https://github.com/openemr/openemr/commit/64f8491d850b2e22ed4fceb14fa67e27fef62cd1, https://github.com/openemr/openemr/pull/13565