CVE-2026-32126— OpenEMR 安全漏洞

OpenEMR: Inverted ACL Condition in CDR ControllerRouter Allows Any Authenticated User to Modify/Delete Clinical Rules and Plans

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, an inverted boolean condition in ControllerRouter::route() causes the admin/super ACL check to be enforced only for controllers that already have their own internal authorization (review, log), while leaving all other CDR controllers — alerts, ajax, edit, add, detail, browse — accessible to any authenticated user. This allows any logged-in user to suppress clinical decision support alerts system-wide, delete or modify clinical plans, and edit rule configurations — all operations intended to require administrator privileges. This vulnerability is fixed in 8.0.0.1.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

授权机制缺失

OpenEMR 安全漏洞

OpenEMR是OpenEMR社区的一套开源的医疗管理系统。该系统可用于医疗实践管理、电子医疗记录、处方书写和医疗帐单申请。 OpenEMR 8.0.0.1之前版本存在安全漏洞，该漏洞源于ControllerRouter::route()中的布尔条件倒置，导致管理员/超级用户访问控制检查仅对已有内部授权的控制器强制执行，而其他所有CDR控制器对任何已验证用户开放，可能导致登录用户抑制临床决策支持警报、删除或修改临床计划以及编辑规则配置。

N/A

N/A