EUVD-2026-125001

OpenEMR before 8.5.0 contains a missing authorization vulnerability in createportallogin.php that allows low-privilege authenticated users to replace patient portal credentials without ACL checks. Attackers can select a victim patient in session and post replacement credentials to take over porta...