CVE-2026-126419

OpenEMR versions before 8.5.0 are vulnerable to a missing authorization vulnerability within the esign_form_submit handler located in library/ESign/Form/Controller.php. The root cause is that the system verifies the caller's password but fails to validate whether the user has authorized access to...