CVE-2026-126322 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.3.0 deserializes a crafted serialized key parameter without sanitizing it, in the patient match dialog. An authenticated user can enumerate patients or force lab orders to attach to the wrong patient.
first public Aug 18, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any OpenEMR deployment before 8.3.0 where users have login accounts can reach the patient match dialog. Patient data and lab order routing are at risk, so clinics and hospitals running self-hosted OpenEMR should prioritize the upgrade. Instances already on 8.3.0 or later are not affected.
Not affected if openemr-8.3.0-or-later
Who cares healthcare, openemr, php, self-hosted
version.php; versions before 8.3.0 are affectedinterface/orders/patient_match_dialog.php with serialized values in the key parameter8.3.0 or laterOpenEMR before 8.3.0 contains an unsanitized deserialization vulnerability that allows authenticated attackers to control patient-matching criteria by supplying a crafted serialized key parameter. Attackers can send serialized arrays to interface/orders/patient_match_dialog.php to enumerate patients or force matches that associate lab orders with the wrong patient.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.