CVE-2026-126415 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR versions before 8.5.0 have a missing authorization check in the Patient Validation module. An authenticated user can send wildcard requests to the patientvalidation endpoint and pull demographic records for the whole patient table.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Clinics and organisations that run OpenEMR, self-hosted or otherwise, before 8.5.0 where any staff account with a login can reach the Patient Validation endpoint. Any authenticated user can enumerate patient demographics, so the exposure is wider than admins. Installations already on 8.5.0 or later are not affected.
Not affected if version-8.5.0-or-later
Who cares healthcare, openemr, self-hosted
version.php; versions below 8.5.0 are affected.8.5.0 or later.OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Patient Validation module that allows any authenticated user to retrieve patient demographic records. Attackers can send direct requests with wildcard mf_lname or empty mf_ parameters to the patientvalidation endpoint to enumerate the entire patient_data table.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.