CVE-2026-32126 - Vulnerability Analysis

Overview

OpenEMR < 8.0.0.1 contains a broken access control caused by an inverted boolean condition in ControllerRouter::route(), letting authenticated users perform admin-only operations like suppressing alerts and modifying clinical plans, exploit requires user authentication.

Severity & Score

Impact

Authenticated users can perform administrator-level actions, compromising clinical decision support and patient care data integrity.

Mitigation

Update to version 8.0.0.1 or later.

References

• https://github.com/openemr/openemr/security/advisories/GHSA-752v-x6m4-6cf8

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner