CVE-2026-126448 OpenEMR before 8.5.0 Missing Authorization in Nation Notes Configuration Handlers

OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows authenticated users lacking nationnotes/nnconfigure to modify shared Nation Notes templates by calling mutation endpoints directly. Attackers can send requests to ajaxcode.php or addcontext.php, which lack ACL and CSR...

CVE-2026-126448

OpenEMR versions before 8.5.0 are vulnerable to a missing authorization flaw within the Nation Notes configuration handlers. The root cause is the lack of ACL and CSRF checks on the ajax_code.php and add_context.php endpoints. This allows authenticated users without the nationnotes/nn_configure p...