CVE-2026-33302

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the module ACL function "AclMain::zhAclCheck" only checks for the presence of any "allow" user or group. It never checks for explicit "deny" allowed=0. As a result,...

CVE-2026-33302: Incorrect Authorization

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the module ACL function AclMain::zhAclCheck only checks for the presence of any "allow" user or group. It never checks for explicit "deny" allowed=0. As a result,...