https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-15T16:48:32.156176+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-126446 CVE-2026-126446 — OpenEMR before 8.5.0 Missing Authorization via destroyed_drugs_report.php 2026-11-15T16:48:32.157426+00:00

Affected: openemr

OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to retrieve destroyed-drug records because destroyed_drugs_report.php lacks the admin/drugs or inventory/reporting ACL check. Attackers can submit the report refresh form with a chosen date range to obtain drug names, NDC, lots, quantities, destruction methods, witnesses, and notes.