{"id":"CVE-2026-126322","kind":"vulnerability","aliases":["CVE-2026-126322"],"related":[],"title":"OpenEMR: unsanitized deserialization lets logged-in users match wrong patients","description":"OpenEMR before 8.3.0 contains an unsanitized deserialization vulnerability that allows authenticated attackers to control patient-matching criteria by supplying a crafted serialized key parameter. Attackers can send serialized arrays to interface/orders/patient_match_dialog.php to enumerate patients or force matches that associate lab orders with the wrong patient.","summary":"OpenEMR before 8.3.0 deserializes a crafted serialized key parameter without sanitizing it, in the patient match dialog. An authenticated user can enumerate patients or force lab orders to attach to the wrong patient.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","php","runtime","self-hosted"],"not_affected_if":["openemr-8.3.0-or-later"],"how_to_check":"- Check the OpenEMR version in the admin footer or `version.php`; versions before `8.3.0` are affected\n- Review web server logs for requests to `interface/orders/patient_match_dialog.php` with serialized values in the key parameter","fix":"- OpenEMR: upgrade to `8.3.0` or later","status":"open","published_at":"2026-11-13T10:17:38+00:00","first_seen_at":"2026-11-13T10:47:16+00:00","triaged_at":"2026-11-13T10:50:51+00:00","updated_at":"2026-11-13T10:50:51+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-13T10:50:51Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: upgrade to `8.3.0` or later","reach":"network","title":"OpenEMR: unsanitized deserialization lets logged-in users match wrong patients","impact":"medium","summary":"OpenEMR before 8.3.0 deserializes a crafted serialized key parameter without sanitizing it, in the patient match dialog. An authenticated user can enumerate patients or force lab orders to attach to the wrong patient.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated users can enumerate patients and misroute lab orders","analyst_note":"","how_to_check":"- Check the OpenEMR version in the admin footer or `version.php`; versions before `8.3.0` are affected\n- Review web server logs for requests to `interface/orders/patient_match_dialog.php` with serialized values in the key parameter","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["openemr-8.3.0-or-later"],"who_is_affected":"Any OpenEMR deployment before 8.3.0 where users have login accounts can reach the patient match dialog. Patient data and lab order routing are at risk, so clinics and hospitals running self-hosted OpenEMR should prioritize the upgrade. Instances already on 8.3.0 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000733,"input_tokens":4619,"output_tokens":542,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126322':14A,17A '-2026':13A,16A '8.3.0':27B,60C 'allow':67C 'array':87C 'associ':97C 'attach':53B 'attack':69C,83C 'authent':43B,68C 'contain':61C 'control':71C 'craft':30B,79C 'criteria':75C 'cve':12A,15A 'deseri':3A,28B,64C 'dialog':41B 'enumer':46B,91C 'forc':49B,94C 'healthcar':18B 'host':24B 'interface/orders/patient_match_dialog.php':89C 'key':32B,81C 'lab':50B,98C 'let':4A 'log':6A 'logged-in':5A 'match':9A,40B,74C,95C 'openemr':1A,19B,25B,58C 'order':51B,99C 'paramet':33B,82C 'patient':11A,39B,47B,57B,73C,92C,103C 'patient-match':72C 'php':20B 'runtim':21B 'sanit':35B 'self':23B 'self-host':22B 'send':85C 'serial':31B,80C,86C 'suppli':77C 'unsanit':2A,63C 'user':8A,44B 'vulner':65C 'without':34B 'wrong':10A,56B,102C","nicknames":[],"mitigations":[],"who_affected":"Any OpenEMR deployment before 8.3.0 where users have login accounts can reach the patient match dialog. Patient data and lab order routing are at risk, so clinics and hospitals running self-hosted OpenEMR should prioritize the upgrade. Instances already on 8.3.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","php","runtime","selfhosted"],"campaign_type":null,"search_a":"'-126322':14A,17A '-2026':13A,16A 'cve':12A,15A 'deseri':3A 'let':4A 'log':6A 'logged-in':5A 'match':9A 'openemr':1A 'patient':11A 'unsanit':2A 'user':8A 'wrong':10A","search_b":"'8.3.0':27B 'attach':53B 'authent':43B 'craft':30B 'deseri':28B 'dialog':41B 'enumer':46B 'forc':49B 'healthcar':18B 'host':24B 'key':32B 'lab':50B 'match':40B 'openemr':19B,25B 'order':51B 'paramet':33B 'patient':39B,47B,57B 'php':20B 'runtim':21B 'sanit':35B 'self':23B 'self-host':22B 'serial':31B 'user':44B 'without':34B 'wrong':56B","search_c":"'8.3.0':60C 'allow':67C 'array':87C 'associ':97C 'attack':69C,83C 'authent':68C 'contain':61C 'control':71C 'craft':79C 'criteria':75C 'deseri':64C 'enumer':91C 'forc':94C 'interface/orders/patient_match_dialog.php':89C 'key':81C 'lab':98C 'match':74C,95C 'openemr':58C 'order':99C 'paramet':82C 'patient':73C,92C,103C 'patient-match':72C 'send':85C 'serial':80C,86C 'suppli':77C 'unsanit':63C 'vulner':65C 'wrong':102C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-08-18T09:04:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126322","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126322","severity":null,"published_at":"2026-11-13T10:17:38+00:00","modified_at":"2026-11-13T10:17:38+00:00","first_seen_at":"2026-11-13T10:47:16+00:00","fetched_at":"2026-11-13T10:47:16+00:00","note":null}],"documents":[{"id":144975,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-r52j-mq9p-mh85","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-18T09:04:54+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144976,"url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-unsanitized-deserialization-via-patient-match-dialog-php","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}