CVE-2026-126433

OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/drugs/dispensedrug.php, which checks only for admin/drugs view permission instead of write permission before dispensing medication. Authenticated users with read-only drug administration access can send GET request...

EUVD-2026-125010

OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/drugs/dispensedrug.php, which checks only for admin/drugs view permission instead of write permission before dispensing medication. Authenticated users with read-only drug administration access can send GET request...

CVE-2026-126433

OpenEMR versions before 8.5.0 are vulnerable to an improper authorization flaw in the interface/drugs/dispense_drug.php component. The root cause is that the system validates only for admin/drugs view permissions instead of the required write permissions when dispensing medication. Consequently, ...

CVE-2026-126433 OpenEMR before 8.5.0 Improper Authorization via dispense_drug.php

OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/drugs/dispensedrug.php, which checks only for admin/drugs view permission instead of write permission before dispensing medication. Authenticated users with read-only drug administration access can send GET request...