CVE-2026-115573

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/classes/Controller.class.php allows explicit controller.php dispatch to controllers missing from CONTROLLERACLMAP, and checkControllerAcl returns without enforcing any...

CVE-2026-115573

The open-source medical practice management application OpenEMR is vulnerable to a broken access control issue in versions prior to 8.3.0 . The root cause is a fail-open dispatcher in library/classes/Controller.class.php, which allows explicit controller.php dispatch to controllers missing from C...

EUVD-2026-117772

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/classes/Controller.class.php allows explicit controller.php dispatch to controllers missing from CONTROLLERACLMAP, and checkControllerAcl returns without enforcing any...

CVE-2026-115573 OpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumeration

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/classes/Controller.class.php allows explicit controller.php dispatch to controllers missing from CONTROLLERACLMAP, and checkControllerAcl returns without enforcing any...