CVE-2026-126479

OpenEMR versions before 8.5.0 are susceptible to a missing authorization vulnerability within five Module Manager InstallerController actions. The root cause is the absence of the admin/manage_modules ACL check and CSRF validation . This allows low-privilege users, such as Front Office accounts, ...