CVE-2026-124468 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR's Standard REST API builds SQL from query-string parameter names in its patient insurance and employer search without escaping them. An authenticated client, including a low-privilege patient-portal token, can read patient health records, user records and API client secrets.
first public Aug 18, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
OpenEMR installations before 8.3.0 that expose the Standard REST API, including patient-portal OAuth2 access. The flaw needs a valid authenticated token, so installations with the REST API disabled or without portal access are less exposed. Teams running OpenEMR for clinics or hospitals should look at this first.
Not affected if openemr-8.3.0-or-later, rest-api-disabled
Who cares healthcare, openemr, patient-data, rest-api
8.3.0 are affected8.3.0 or laterOpenEMR before 8.3.0 contains an SQL injection vulnerability in the Standard REST API patient insurance and employer search, which concatenates query-string parameter names into SQL as column identifiers without escaping. Authenticated clients, including low-privilege patient-portal OAuth2 tokens, can send crafted parameter names to /api/patient/{puuid}/insurance or /api/patient/{puuid}/employer to extract patient PHI, user records, and API client secrets.
This page as .md ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.