CVE-2026-115573

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/classes/Controller.class.php allows explicit controller.php dispatch to controllers missing from CONTROLLER_ACL_MAP, and checkControllerAcl() returns without enforcing any permission for those entries. A low-privilege authenticated user can invoke C_X12Partner::edit_action_process() to create or alter insurance-routing hosts and credentials, or invoke C_PatientFinder::find_action_process() to enumerate patient names, dates of birth, and identifiers. The shared fail-open dispatcher root cause also exposes other administrative controllers that were intended to be reached through ACL-gated Practice Settings routes. This issue is fixed in version 8.3.0.

• CWE-862

• https://github.com/openemr/openemr/commit/64f8491d850b2e22ed4fceb14fa67e27fef62cd1
• https://github.com/openemr/openemr/pull/13565
• https://github.com/openemr/openemr/releases/tag/v8_3_0
• https://github.com/openemr/openemr/security/advisories/GHSA-9rj4-fxmj-c4r7
• https://github.com/openemr/openemr/security/advisories/GHSA-9rj4-fxmj-c4r7

Published

Nov 5, 2026

Last Modified

Nov 5, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11556A security flaw has been discovered in Tenda F451 1.0.0.7/1.…8.8
• CVE-2026-115567Tokio is a runtime for writing applications with Rust. In 1.…5.8
• CVE-2026-115569Fallow is a codebase intelligence tool for TypeScript and Ja…3.3
• CVE-2026-11557A weakness has been identified in Tenda F451 1.0.0.7/1.0.0.9…8.8
• CVE-2026-115570Electron is a framework for writing cross-platform desktop a…7.4
• CVE-2026-115572pypdf is a free and open-source pure-python PDF library. Pri…7.1
• CVE-2026-115574Zulip is an open-source team collaboration tool. From 11.0 u…5.3
• CVE-2026-11558A security vulnerability has been detected in CodeAstro Payr…6.3
• CVE-2026-115580pypdf is a free and open-source pure-python PDF library. Pri…7.1
• CVE-2026-115585pypdf is a free and open-source pure-python PDF library. Pri…7.1
• CVE-2026-115586virtualenv is a tool for creating isolated virtual python en…7.1
• CVE-2026-11559A vulnerability was detected in CodeAstro Payroll System 1.0…6.3