{"id":"CVE-2026-124444","kind":"vulnerability","aliases":["CVE-2026-124444"],"related":[],"title":"OpenEMR: patient portal API lets logged-in patients read any database table","description":"OpenEMR before 8.4.0 contains a mass assignment vulnerability in the patient portal OnsiteDocument query API that lets request parameters set bitwise criteria filters whose values are placed unquoted into the SQL WHERE clause. Authenticated patient portal users can inject SQL via parameters such as Id_BitwiseAnd to read any database table, including other patients' records and staff password hashes.","summary":"OpenEMR before 8.4.0 has a mass assignment flaw in the patient portal OnsiteDocument query API, where request parameters such as Id_BitwiseAnd are placed unquoted into an SQL WHERE clause. An authenticated patient portal user can inject SQL to read any database table, including other patients' records and staff password hashes.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","other","patient-portal","self-hosted"],"not_affected_if":["no-portal-accounts","patient-portal-disabled"],"how_to_check":"- Check the OpenEMR version in the installed application, for example `8.3.x` or lower means affected.\n- Confirm whether the patient portal is enabled and reachable by patients.","fix":"- OpenEMR: move to `8.4.0` or later.","status":"open","published_at":"2026-11-08T14:18:11+00:00","first_seen_at":"2026-11-08T14:48:39+00:00","triaged_at":"2026-11-08T14:49:51+00:00","updated_at":"2026-11-08T14:49:51+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-08T14:49:51Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.4.0` or later.","reach":"internet","title":"OpenEMR: patient portal API lets logged-in patients read any database table","impact":"high","summary":"OpenEMR before 8.4.0 has a mass assignment flaw in the patient portal OnsiteDocument query API, where request parameters such as Id_BitwiseAnd are placed unquoted into an SQL WHERE clause. An authenticated patient portal user can inject SQL to read any database table, including other patients' records and staff password hashes.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","healthcare","patient-portal","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads any database table, including staff password hashes.","analyst_note":"","how_to_check":"- Check the OpenEMR version in the installed application, for example `8.3.x` or lower means affected.\n- Confirm whether the patient portal is enabled and reachable by patients.\n- unknown for further detection steps.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patient-portal-disabled","no-portal-accounts"],"who_is_affected":"Healthcare organizations running OpenEMR with the patient portal enabled are exposed, since any authenticated patient portal user can reach the vulnerable query API. Installations with the patient portal disabled or without patient portal accounts are not reachable through this path. Staff and administrators should check whether patient portal accounts are open to outside users.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000751,"input_tokens":4634,"output_tokens":575,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124444':16A,19A '-2026':15A,18A '8.4.0':31B,82C 'api':4A,43B,94C 'assign':35B,86C 'authent':60B,113C 'bitwis':100C 'bitwiseand':50B,125C 'claus':58B,112C 'contain':83C 'criteria':101C 'cve':14A,17A 'databas':12A,70B,129C 'filter':102C 'flaw':36B 'hash':79B,138C 'healthcar':20B 'host':28B 'id':49B,124C 'includ':72B,131C 'inject':65B,118C 'let':5A,96C 'log':7A 'logged-in':6A 'mass':34B,85C 'onsitedocu':41B,92C 'openemr':1A,21B,29B,80C 'paramet':46B,98C,121C 'password':78B,137C 'patient':2A,9A,24B,39B,61B,74B,90C,114C,133C 'patient-port':23B 'place':52B,106C 'portal':3A,25B,40B,62B,91C,115C 'queri':42B,93C 'read':10A,68B,127C 'record':75B,134C 'request':45B,97C 'self':27B 'self-host':26B 'set':99C 'sql':56B,66B,110C,119C 'staff':77B,136C 'tabl':13A,71B,130C 'unquot':53B,107C 'user':63B,116C 'valu':104C 'via':120C 'vulner':87C 'whose':103C","nicknames":[],"mitigations":[],"who_affected":"Healthcare organizations running OpenEMR with the patient portal enabled are exposed, since any authenticated patient portal user can reach the vulnerable query API. Installations with the patient portal disabled or without patient portal accounts are not reachable through this path. Staff and administrators should check whether patient portal accounts are open to outside users.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","other","patientportal","selfhosted"],"campaign_type":null,"search_a":"'-124444':16A,19A '-2026':15A,18A 'api':4A 'cve':14A,17A 'databas':12A 'let':5A 'log':7A 'logged-in':6A 'openemr':1A 'patient':2A,9A 'portal':3A 'read':10A 'tabl':13A","search_b":"'8.4.0':31B 'api':43B 'assign':35B 'authent':60B 'bitwiseand':50B 'claus':58B 'databas':70B 'flaw':36B 'hash':79B 'healthcar':20B 'host':28B 'id':49B 'includ':72B 'inject':65B 'mass':34B 'onsitedocu':41B 'openemr':21B,29B 'paramet':46B 'password':78B 'patient':24B,39B,61B,74B 'patient-port':23B 'place':52B 'portal':25B,40B,62B 'queri':42B 'read':68B 'record':75B 'request':45B 'self':27B 'self-host':26B 'sql':56B,66B 'staff':77B 'tabl':71B 'unquot':53B 'user':63B","search_c":"'8.4.0':82C 'api':94C 'assign':86C 'authent':113C 'bitwis':100C 'bitwiseand':125C 'claus':112C 'contain':83C 'criteria':101C 'databas':129C 'filter':102C 'hash':138C 'id':124C 'includ':131C 'inject':118C 'let':96C 'mass':85C 'onsitedocu':92C 'openemr':80C 'paramet':98C,121C 'password':137C 'patient':90C,114C,133C 'place':106C 'portal':91C,115C 'queri':93C 'read':127C 'record':134C 'request':97C 'set':99C 'sql':110C,119C 'staff':136C 'tabl':130C 'unquot':107C 'user':116C 'valu':104C 'via':120C 'vulner':87C 'whose':103C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-13T09:45:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124444","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124444","severity":null,"published_at":"2026-11-08T14:18:11+00:00","modified_at":"2026-11-08T14:18:11+00:00","first_seen_at":"2026-11-08T14:48:39+00:00","fetched_at":"2026-11-08T14:48:39+00:00","note":null}],"documents":[{"id":102072,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-hx8r-g8gw-6g2j","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-13T09:45:33+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102073,"url":"https://www.vulncheck.com/advisories/openemr-before-8.4.0-sql-injection-via-onsitedocument-query-api","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}