Sources: National Vulnerability Database, CVE.org, CISA KEV, FIRST EPSS
CVE-2026-126416 Overview
OpenEMR before 8.5.0 contains an improper authorization vulnerability in patient_tracker_status.php that allows low-privilege authenticated users to modify other patients' tracker entries by supplying arbitrary tracker_id values. Attackers can post statustype and roomnum parameters with a valid CSRF token to alter patient-flow status, room assignments, and linked calendar appointment state.
Critical Impact
Affected Products
- OpenEMR: see the vendor advisory for the exact affected versions
Discovery Timeline
- 2026-11-13: CVE-2026-126416 published to the National Vulnerability Database by disclosure@vulncheck.com
- 2026-11-13: last updated in the NVD database
Technical Details for CVE-2026-126416
Vulnerability Analysis
CVE-2026-126416 is a Improper Authorization weakness (CWE-285: Improper Authorization) in OpenEMR. Based on its CVSS vector, the flaw can be reached over the network, needs some level of access, and needs no user interaction. The software does not check whether a user is allowed to perform an action.
With a CVSS base score of 7.1 and an EPSS exploitation probability of 0.35 percent, apply the vendor fix and confirm exposure on internet facing and business critical assets first.
Root Cause
The weakness is classified as CWE-285: Improper Authorization. The software does not check whether a user is allowed to perform an action.
Attack Vector
Based on the CVSS vector, the flaw can be reached over the network, needs some level of access, and needs no user interaction. Attack complexity is low complexity.
No exploitation in the wild is confirmed by CISA at the time of the last update. Check the references below for any vendor or researcher proof of concept.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Detection Methods for CVE-2026-126416
Detection Strategies
- Inventory every instance of OpenEMR and compare the running version with the affected range above.
- Check external attack surface scans for internet facing instances of the component.
- Run an authenticated vulnerability scan once your scanner ships a check for this CVE.
Monitoring Recommendations
- Forward OpenEMR application, access and audit logs to your SIEM for retrospective hunting.
- Alert on new processes, configuration changes or outbound connections from the affected service.
- Track the vendor advisory and the CISA KEV catalog for changes in exploitation status.
How to Mitigate CVE-2026-126416
Immediate Actions Required
- Apply the fixed version of OpenEMR named in the vendor advisory.
- Prioritize internet facing and business critical instances first.
- Rescan after the change to confirm the exposure is closed.
Patch Information
Use the fixed version listed in the vendor advisory for OpenEMR.
Workarounds
- If patching must wait, restrict network access to the affected service and place it behind authentication or a web application firewall rule.
CWE References
- CWE-285: Improper Authorization More CVEs with this weakness
Technical References
This entry is built directly from NVD, CISA KEV and EPSS data. Verify fixed versions in the vendor advisory before you deploy.
Frequently asked questions
Related CVEs
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
In addInputMethodListener of com.android.server.inputmethod.InputMethodManagerService, there is a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any tenant's cached flow parameters.
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to gain administrative access via the heartbeat refresh API and execute arbitrary code on the server. This issue has been patched in FUXA version 1.2.10.
PolarLearn is a free and open-source learning program. In 0-PRERELEASE-16 and earlier, the group chat WebSocket at wss://polarlearn.nl/api/v1/ws can be used without logging in. An unauthenticated client can subscribe to any group chat by providing a group UUID, and can also send messages to any group. The server accepts the message and stores it in the group’s chatContent, so this is not just a visual spam issue.
Improper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
Earn your free CTEM certification.
Learn to scope, prioritize, validate and mobilize fixes for CVEs like CVE-2026-126416 with a free CTEM certification.
Beginner / Practitioner / Program Leader
Explore certifications