CVE-2026-126416 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 lets a low-privilege logged-in user change other patients' tracker entries by supplying arbitrary tracker_id values to patient_tracker_status.php. An attacker can alter patient-flow status, room assignments, and linked calendar appointment state.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Clinics and hospitals running OpenEMR before 8.5.0 with low-privilege staff accounts that can reach the patient tracker. Installations on 8.5.0 or later are not affected by this flaw.
Not affected if openemr-8.5.0-or-later
Who cares healthcare, openemr, self-hosted
8.5.0 are listed as affected.8.5.0 or later, per the NVD description.OpenEMR before 8.5.0 contains an improper authorization vulnerability in patient_tracker_status.php that allows low-privilege authenticated users to modify other patients' tracker entries by supplying arbitrary tracker_id values. Attackers can post statustype and roomnum parameters with a valid CSRF token to alter patient-flow status, room assignments, and linked calendar appointment state.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.