CVE-2026-126437

OpenEMR versions before 8.5.0 are susceptible to an authorization bypass vulnerability in portal/lib/download_template.php. The flaw allows any authenticated core user to bypass ACL and squad restrictions by manipulating the isModule parameter. By submitting arbitrary pid and template_id values, ...