CVE-2026-112678
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.
CVSS
5.5
Medium
EPSS
0.2%
p5
KEV
—
Exploit Today
2
0-100
Published: Oct 26, 2026 · Last modified: Nov 2, 2026 · CWE-862
0.2%EPSS · 30 days0.2%
2026-10-272026-11-07
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2, watchOS 27.2. An app may be able to access sensitive user data.
- support.apple.comhttps://support.apple.com/en-us/149227
- support.apple.comhttps://support.apple.com/en-us/149230
- support.apple.comhttps://support.apple.com/en-us/149521
- support.apple.comhttps://support.apple.com/en-us/149522
- support.apple.comhttps://support.apple.com/en-us/149523
- support.apple.comhttps://support.apple.com/en-us/149525
- support.apple.comhttps://support.apple.com/en-us/149526
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1244888.1 HIG—
———OpenEMR before 8.3.0 contains an authorization bypass vulnerability that allows authenticated clinicians lacking high-sensitivity permission to read and modify encounter-bound forms via load_form.php. Attackers can request the Clinical Notes or Care Plan direct loader to obtain restricted content and a CSRF token, then submit save.php to tamper with clinical records.1hCVE-2026-1244868.8 HIG—
———OpenEMR before 8.3.0 contains a missing authorization vulnerability in the classic document controller that allows low-privilege authenticated users to recategorize other patients' documents. Attackers can invoke move_action_process to move a document into a patients|demo category, then retrieve it with an empty patient_id to exfiltrate PHI and tamper with charts.1hCVE-2026-1244848.8 HIG—
———OpenEMR before 8.4.0 contains a missing authorization vulnerability in portal onsite-document APIs that allows any authenticated core user to access cross-patient documents. Attackers can omit the patientId parameter and supply arbitrary record IDs to list, read, and overwrite other patients' portal documents, signatures, and template data.1hCVE-2026-1244808.8 HIG—
———OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed api_csrf_token_js value to skip FHIR scope checks and call GET /fhir/QuestionnaireResponse, exfiltrating site-wide questionnaire answer PHI.1hCVE-2026-1244786.5 MED—
———OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.php that allows low-privileged authenticated users to modify arbitrary patients' recall data. Attackers can submit a crafted new_pid with recall, contact, provider, facility, and notification preference fields to overwrite records of patients they cannot access.1hCVE-2026-1244778.8 HIG—
———OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete arbitrary patient recall records via the delete_Recall action. Attackers can send POST requests to /interface/main/messages/save.php with a target pid and r_ID to remove recall data without ACL or ownership checks.1h