What is the CVSS score of CVE-2026-32126?

CVE-2026-32126 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Openemr are affected by CVE-2026-32126?

OpenEMR deployments are vulnerable to privilege escalation where any authenticated user can access sensitive clinical decision support and patient record functions normally restricted to…

How to fix or mitigate CVE-2026-32126?

Within 24 hours: inventory all OpenEMR instances and verify versions pre-8.0.0.1; disable non-admin user access to clinical modules if possible. Within 7 days: implement compensating controls (WAF rules blocking /admin/ routes for non-admin roles, network segmentation isolating OpenEMR, enable audit logging on CDR controllers). Within 30 days: engage vendor for patch timeline; evaluate migration to patched version or replacement solution; conduct access audit for unauthorized PHI access during vulnerability window.

Openemr CVE-2026-32126

HIGH

Missing Authorization (CWE-862)

2026-03-11 security-advisories@github.com

Authentication Bypass Openemr

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:07 vuln.today

CVE Published

Mar 11, 2026 - 21:16 nvd

HIGH 7.1

DescriptionGitHub Advisory

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, an inverted boolean condition in ControllerRouter::route() causes the admin/super ACL check to be enforced only for controllers that already have their own internal authorization (review, log), while leaving all other CDR controllers - alerts, ajax, edit, add, detail, browse - accessible to any authenticated user. This allows any logged-in user to suppress clinical decision support alerts system-wide, delete or modify clinical plans, and edit rule configurations - all operations intended to require administrator privileges. This vulnerability is fixed in 8.0.0.1.

AnalysisAI

OpenEMR versions prior to 8.0.0.1 contain an inverted boolean condition in the access control logic that allows any authenticated user to access administrative CDR controllers (alerts, ajax, edit, add, detail, browse) intended for administrators only. Affected users can suppress clinical decision support alerts, delete or modify clinical plans, and edit rule configurations without proper authorization. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate as low-privilege user

Exploit

Access CDR controllers without admin ACL

Execution

Modify clinical plans or suppress alerts

Impact

Compromise clinical decision support