CVE-2026-32126: OpenEMR Privilege Escalation Vulnerability

CVE-2026-32126 Overview

CVE-2026-32126 is an authorization bypass vulnerability in OpenEMR, a free and open source electronic health records (EHR) and medical practice management application. The vulnerability stems from an inverted boolean condition in the ControllerRouter::route() function that causes the admin/super ACL check to be incorrectly enforced. Instead of protecting sensitive CDR (Clinical Decision Support Rules) controllers, the flawed logic only enforces authorization for controllers that already have their own internal authorization mechanisms (such as review and log), while leaving critical controllers accessible to any authenticated user.

Critical Impact

Any authenticated user can suppress clinical decision support alerts system-wide, delete or modify clinical plans, and edit rule configurations — all operations intended to require administrator privileges.

Affected Products

• OpenEMR versions prior to 8.0.0.1

Discovery Timeline

• March 11, 2026 - CVE-2026-32126 published to NVD
• March 12, 2026 - Last updated in NVD database

Technical Details for CVE-2026-32126

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization). The root cause is a logic error in the access control implementation within the Clinical Decision Support Rules (CDR) module. The inverted boolean condition creates a situation where authorization checks are applied to the wrong set of controllers, effectively bypassing access control for sensitive administrative functions.

The affected CDR controllers include alerts, ajax, edit, add, detail, and browse — all of which should require administrator or super-user privileges but are instead accessible to any authenticated user. This represents a critical failure in the principle of least privilege, as regular clinical staff could manipulate system-wide clinical decision support settings.

Root Cause

The vulnerability originates from an inverted boolean condition in the ControllerRouter::route() function. The conditional logic that determines whether to enforce the admin/super ACL check is reversed, causing the security check to be applied only to controllers that already implement their own internal authorization (such as review and log controllers). This leaves all other CDR controllers unprotected and accessible to any user who has authenticated to the system, regardless of their privilege level.

Attack Vector

The attack can be executed remotely over the network by any authenticated user. An attacker with basic user credentials can directly access the unprotected CDR controller endpoints to perform administrative actions. The exploitation does not require any user interaction and can be performed with low complexity.

The affected endpoints allow attackers to:

• Suppress clinical decision support alerts system-wide via the alerts controller
• Delete or modify clinical plans through the edit and delete operations
• Add unauthorized clinical rules via the add controller
• Access detailed configuration data through detail and browse controllers

Since this vulnerability affects healthcare systems, unauthorized modifications to clinical decision support alerts could have patient safety implications by suppressing important clinical warnings or modifying treatment protocols.

Detection Methods for CVE-2026-32126

Indicators of Compromise

• Unexpected access to CDR controller endpoints (/interface/super/rules/) by non-administrator users
• Audit logs showing clinical rule modifications by users without administrative privileges
• System-wide clinical decision support alerts being suppressed without authorized administrator action
• Unusual patterns of clinical plan deletions or modifications

Detection Strategies

• Review web server access logs for requests to CDR controller paths by non-administrative user sessions
• Implement monitoring for changes to clinical decision support configurations and cross-reference with authorized administrator activities
• Enable verbose logging for the OpenEMR CDR module to capture unauthorized access attempts
• Deploy application-layer monitoring to detect anomalous authorization patterns

Monitoring Recommendations

• Configure alerts for any modifications to clinical rules, plans, or alert configurations
• Establish baseline behavior for CDR controller access and alert on deviations
• Integrate OpenEMR logs with SIEM solutions for correlation of unauthorized access patterns
• Regularly audit user access levels and compare against CDR module activity logs

How to Mitigate CVE-2026-32126

Immediate Actions Required

• Upgrade OpenEMR to version 8.0.0.1 or later immediately
• Review audit logs for any unauthorized modifications to clinical decision support rules prior to patching
• Verify all clinical alerts and plans are in their expected state after patching
• Implement network segmentation to limit access to OpenEMR administrative interfaces

Patch Information

The vulnerability is fixed in OpenEMR version 8.0.0.1. Organizations should upgrade to this version or later as soon as possible. The patch corrects the inverted boolean condition in ControllerRouter::route() to properly enforce admin/super ACL checks on all sensitive CDR controllers.

For detailed information about the security fix, refer to the GitHub Security Advisory GHSA-752v-x6m4-6cf8.

Workarounds

• Implement web application firewall (WAF) rules to restrict access to CDR controller endpoints (/interface/super/rules/) to administrator IP ranges only
• Use network access controls to limit which users can reach the OpenEMR application server
• Temporarily disable the CDR module if clinical decision support functionality is not critical until patching can be completed
• Enforce strict session validation and additional authentication for administrative functions at the network level