CVE-2026-32126
Published: 11 March 2026
Summary
CVE-2026-32126 is a high-severity Missing Authorization (CWE-862) vulnerability in Open-Emr Openemr. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 17.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-32126 is a missing authorization vulnerability (CWE-862) affecting OpenEMR, a free and open source electronic health records and medical practice management application. In versions prior to 8.0.0.1, an inverted boolean condition in the ControllerRouter::route() function causes the admin/superuser access control list (ACL) check to be enforced only for controllers that already have their own internal authorization, such as review and log. This leaves other clinical decision rules (CDR) controllers—alerts, ajax, edit, add, detail, and browse—accessible to any authenticated user, bypassing intended administrator privileges.
Any low-privileged authenticated user can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows the attacker to suppress clinical decision support alerts system-wide, delete or modify clinical plans, and edit rule configurations, resulting in high integrity impact and low availability impact as rated by the CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).
The GitHub Security Advisory (GHSA-752v-x6m4-6cf8) confirms the issue and states that it is fixed in OpenEMR version 8.0.0.1, recommending that users upgrade to this patched release to mitigate the vulnerability.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11399
Vulnerability details
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, an inverted boolean condition in ControllerRouter::route() causes the admin/super ACL check to be enforced only for controllers that already have their own…
more
internal authorization (review, log), while leaving all other CDR controllers — alerts, ajax, edit, add, detail, browse — accessible to any authenticated user. This allows any logged-in user to suppress clinical decision support alerts system-wide, delete or modify clinical plans, and edit rule configurations — all operations intended to require administrator privileges. This vulnerability is fixed in 8.0.0.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization enables low-privileged authenticated users to exploit the public-facing OpenEMR web application (T1190) for privilege escalation to admin/superuser actions (T1068) such as modifying/deleting clinical plans and editing configurations.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for access to system resources, directly addressing the bypassed admin/super ACL checks in ControllerRouter::route() for CDR controllers.
Employs least privilege to restrict low-privileged authenticated users from performing administrator-only operations like modifying clinical plans or suppressing alerts.
Requires a tamper-resistant reference monitor mechanism to enforce access control policies without bypass, mitigating the inverted boolean logic flaw in the routing function.