{"id":"CVE-2026-126415","kind":"vulnerability","aliases":["CVE-2026-126415"],"related":[],"title":"OpenEMR: any logged-in user can read all patient demographic records","description":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Patient Validation module that allows any authenticated user to retrieve patient demographic records. Attackers can send direct requests with wildcard mf_lname or empty mf_ parameters to the patientvalidation endpoint to enumerate the entire patient_data table.","summary":"OpenEMR versions before 8.5.0 have a missing authorization check in the Patient Validation module. An authenticated user can send wildcard requests to the patientvalidation endpoint and pull demographic records for the whole patient table.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","runtime","self-hosted"],"not_affected_if":["version-8.5.0-or-later"],"how_to_check":"- Check the installed OpenEMR version in the admin footer or `version.php`; versions below `8.5.0` are affected.\n- Confirm whether the Patient Validation endpoint is reachable by ordinary logged-in users.","fix":"- OpenEMR: move to `8.5.0` or later.","status":"open","published_at":"2026-11-13T10:17:46+00:00","first_seen_at":"2026-11-13T10:47:20+00:00","triaged_at":"2026-11-13T10:53:11+00:00","updated_at":"2026-11-13T10:53:11+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-13T10:53:11Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.5.0` or later.","reach":"network","title":"OpenEMR: any logged-in user can read all patient demographic records","impact":"high","summary":"OpenEMR versions before 8.5.0 have a missing authorization check in the Patient Validation module. An authenticated user can send wildcard requests to the patientvalidation endpoint and pull demographic records for the whole patient table.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","self-hosted","healthcare"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"any logged-in user reads all patient demographic records","analyst_note":"","how_to_check":"- Check the installed OpenEMR version in the admin footer or `version.php`; versions below `8.5.0` are affected.\n- Confirm whether the Patient Validation endpoint is reachable by ordinary logged-in users.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-8.5.0-or-later"],"who_is_affected":"Clinics and organisations that run OpenEMR, self-hosted or otherwise, before 8.5.0 where any staff account with a login can reach the Patient Validation endpoint. Any authenticated user can enumerate patient demographics, so the exposure is wider than admins. Installations already on 8.5.0 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000729,"input_tokens":4608,"output_tokens":537,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126415':15A,18A '-2026':14A,17A '8.5.0':28B,61C 'allow':73C 'attack':82C 'authent':40B,75C 'author':32B,65C 'check':33B 'contain':62C 'cve':13A,16A 'data':104C 'demograph':11A,52B,80C 'direct':85C 'empti':92C 'endpoint':49B,98C 'entir':102C 'enumer':100C 'healthcar':19B 'host':24B 'lname':90C 'log':4A 'logged-in':3A 'mf':89C,93C 'miss':31B,64C 'modul':38B,71C 'openemr':1A,20B,25B,59C 'paramet':94C 'patient':10A,36B,57B,69C,79C,103C 'patientvalid':48B,97C 'pull':51B 'read':8A 'record':12A,53B,81C 'request':45B,86C 'retriev':78C 'runtim':21B 'self':23B 'self-host':22B 'send':43B,84C 'tabl':58B,105C 'user':6A,41B,76C 'valid':37B,70C 'version':26B 'vulner':66C 'whole':56B 'wildcard':44B,88C","nicknames":[],"mitigations":[],"who_affected":"Clinics and organisations that run OpenEMR, self-hosted or otherwise, before 8.5.0 where any staff account with a login can reach the Patient Validation endpoint. Any authenticated user can enumerate patient demographics, so the exposure is wider than admins. Installations already on 8.5.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","runtime","selfhosted"],"campaign_type":null,"search_a":"'-126415':15A,18A '-2026':14A,17A 'cve':13A,16A 'demograph':11A 'log':4A 'logged-in':3A 'openemr':1A 'patient':10A 'read':8A 'record':12A 'user':6A","search_b":"'8.5.0':28B 'authent':40B 'author':32B 'check':33B 'demograph':52B 'endpoint':49B 'healthcar':19B 'host':24B 'miss':31B 'modul':38B 'openemr':20B,25B 'patient':36B,57B 'patientvalid':48B 'pull':51B 'record':53B 'request':45B 'runtim':21B 'self':23B 'self-host':22B 'send':43B 'tabl':58B 'user':41B 'valid':37B 'version':26B 'whole':56B 'wildcard':44B","search_c":"'8.5.0':61C 'allow':73C 'attack':82C 'authent':75C 'author':65C 'contain':62C 'data':104C 'demograph':80C 'direct':85C 'empti':92C 'endpoint':98C 'entir':102C 'enumer':100C 'lname':90C 'mf':89C,93C 'miss':64C 'modul':71C 'openemr':59C 'paramet':94C 'patient':69C,79C,103C 'patientvalid':97C 'record':81C 'request':86C 'retriev':78C 'send':84C 'tabl':105C 'user':76C 'valid':70C 'vulner':66C 'wildcard':88C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T02:17:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126415","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126415","severity":null,"published_at":"2026-11-13T10:17:46+00:00","modified_at":"2026-11-13T10:17:47+00:00","first_seen_at":"2026-11-13T10:47:20+00:00","fetched_at":"2026-11-13T10:47:20+00:00","note":null}],"documents":[{"id":145073,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-q4jf-6gcg-m3jx","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T02:17:21+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145074,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-patientvalidation-module","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}