Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/classes/Controller.class.php allows explicit controller.php dispatch to controllers missing from CONTROLLER_ACL_MAP, and checkControllerAcl() returns without enforcing any permission for those entries. A low-privilege authenticated user can invoke C_X12Partner::edit_action_process() to create or alter insurance-routing hosts and credentials, or invoke C_PatientFinder::find_action_process() to enumerate patient names, dates of birth, and identifiers. The shared fail-open dispatcher root cause also exposes other administrative controllers that were intended to be reached through ACL-gated Practice Settings routes. This issue is fixed in version 8.3.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-11-05T20:17:42.803Z",
  "pubdate": "2026-11-05T20:17:42.803Z",
  "executiveSummary": "The vulnerability involves an improper access control flaw within the OpenEMR controller dispatch mechanism, specifically affecting versions prior to 8.3.0.\nThe issue resides in library/classes/Controller.class.php, where the system fails to enforce security constraints for controllers absent from the CONTROLLER_ACL_MAP.\nBecause the checkControllerAcl() function incorrectly defaults to a fail-open state for unregistered controllers, unauthorized or low-privilege authenticated users can access sensitive administrative functions that were intended to be restricted.\nThe impact includes the potential for unauthorized data manipulation, such as altering insurance-routing configurations, as well as the exfiltration of sensitive patient identifiers, including names and dates of birth.\nThis vulnerability poses a significant risk to the confidentiality and integrity of protected health information (PHI) within the medical practice management application.\nExploitation requires an authenticated user account, but the vulnerability effectively bypasses the intended authorization framework, allowing attackers to leverage hidden or protected administrative endpoints without the necessary permissions.",
  "technicalDetails": "The root cause of this vulnerability is an insecure dispatch logic implemented in library/classes/Controller.class.php. The application utilizes a centralized mechanism to route requests to specific controllers; however, the validation logic contained within checkControllerAcl() does not provide a robust 'deny-by-default' stance.\nWhen a request is made to a controller not explicitly defined within the CONTROLLER_ACL_MAP, the dispatcher proceeds to execute the requested action without verifying the user's privilege level. This design flaw treats missing entries as implicitly authorized rather than restricted.\nThe attack flow begins when an authenticated user crafts a request targeting specific controller actions that are not mapped in the access control list. By bypassing the intended gated paths, the attacker can invoke sensitive methods such as C_X12Partner::edit_action_process().\nInvoking C_X12Partner::edit_action_process() allows an attacker to interact with backend insurance-routing configurations. This can be weaponized to modify credentials or routing hosts, potentially leading to unauthorized redirection of billing data or persistent access to insurance interfaces.\nFurthermore, the vulnerability enables access to C_PatientFinder::find_action_process(). This function is intended for legitimate patient lookup but, when accessed without authorization, permits the mass enumeration of PII (Personally Identifiable Information) and PHI, including patient names, birth dates, and internal identifiers.\nBecause this fail-open behavior applies to all administrative controllers that were improperly omitted from the ACL map, the attack surface extends to any administrative functionality reachable via the controller.php dispatcher.\nThis vulnerability affects all OpenEMR versions prior to 8.3.0. The authentication requirement is minimal, as any low-privilege authenticated session provides the necessary context to submit requests that the flawed dispatcher fails to validate against the global access control policy.\nPost-exploitation activities are limited only by the functionality exposed by the accessible controllers, which includes unauthorized modification of application settings, credential management, and unauthorized data extraction."
}