CVE-2026-126440

OpenEMR before version 8.5.0 contains a missing authorization flaw in the Care Coordination CCDA and CCR import controllers. The vulnerability allows an authenticated non-administrator with Care Coordination access to move a document—specified by the document_id parameter—into the import category...

EUVD-2026-125003

OpenEMR before 8.5.0 contains a missing authorization flaw in the Care Coordination CCDA and CCR import controllers, which move a document named by the documentid parameter into the import category without checking access to the source document. Authenticated non-administrators with Care...