CVE-2026-32126

OpenEMR prior to version 8.0.0.1 contains an inverted boolean condition in ControllerRouter::route() that enforces the admin/super ACL check only for controllers with their own internal authorization (e.g., review, log). As a result, all other CDR controllers (alerts, ajax, edit, add, detail, bro...