https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 08:37:08 +0000 https://vulnerability.circl.lu/vuln/cve-2026-33302 <p><strong>Affected:</strong> openemr</p> <p>OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the module ACL function `AclMain::zhAclCheck()` only checks for the presence of any &#34;allow&#34; (user or group). It never checks for explicit &#34;deny&#34; (allowed=0). As a result, administrators cannot revoke access by setting a user or group to &#34;deny&#34;; if the user is in a group that has &#34;allow,&#34; access is granted regardless of explicit denies. Version 8.0.0.2 fixes the issue.</p> <p><strong>Affected:</strong> openemr</p> <p>OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the module ACL function `AclMain::zhAclCheck()` only checks for the presence of any &#34;allow&#34; (user or group). It never checks for explicit &#34;deny&#34; (allowed=0). As a result, administrators cannot revoke access by setting a user or group to &#34;deny&#34;; if the user is in a group that has &#34;allow,&#34; access is granted regardless of explicit denies. Version 8.0.0.2 fixes the issue.</p> https://vulnerability.circl.lu/vuln/cve-2026-33302