CVE-2026-126444

OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Ensora eRx integration that allows authenticated staff without patients/rx permission to access prescription data by directly requesting eRx.php. Attackers can expose selected patients' demographic, medication, and allergy...

CVE-2026-126444 OpenEMR before 8.5.0 Missing Authorization in Ensora eRx via eRx.php

OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Ensora eRx integration that allows authenticated staff without patients/rx permission to access prescription data by directly requesting eRx.php. Attackers can expose selected patients' demographic, medication, and allergy...

EUVD-2026-124997

OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Ensora eRx integration that allows authenticated staff without patients/rx permission to access prescription data by directly requesting eRx.php. Attackers can expose selected patients' demographic, medication, and allergy...

CVE-2026-126444 OpenEMR before 8.5.0 Missing Authorization in Ensora eRx via eRx.php

OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Ensora eRx integration that allows authenticated staff without patients/rx permission to access prescription data by directly requesting eRx.php. Attackers can expose selected patients' demographic, medication, and allergy...

CVE-2026-126444

OpenEMR versions prior to 8.5.0 are vulnerable to a missing authorization flaw within the Ensora eRx integration . Specifically, authenticated staff members who lack the necessary patients/rx permissions can bypass access controls by directly requesting the eRx.php endpoint. This allows unauthori...