{"id":"CVE-2026-126419","kind":"vulnerability","aliases":["CVE-2026-126419"],"related":[],"title":"OpenEMR: any logged-in staff can sign and lock other patients' forms","description":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in the esign_form_submit handler of library/ESign/Form/Controller.php that verifies only the caller's password, not access to the patient, encounter, or form type. Authenticated core users can supply arbitrary formId, formDir, and encounterId values to sign and lock any patient's clinical form, creating unauthorized approval records and blocking normal editing.","summary":"OpenEMR's electronic signature handler checks only the caller's password, not whether they may access the patient, encounter or form. An authenticated core user can sign and lock any patient's clinical form, creating false approval records and blocking normal editing.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","runtime","self-hosted"],"not_affected_if":["no-user-accounts","version-8.5.0-or-later"],"how_to_check":"- Check the installed OpenEMR version (`version` in the OpenEMR config or admin footer); versions below `8.5.0` are listed as affected.\n- Look for `library/ESign/Form/Controller.php` in the install and review the `esign_form_submit` handler.","fix":"- OpenEMR `8.5.0` (fixed in releases before 8.5.0 as stated by the source)","status":"open","published_at":"2026-11-13T10:17:47+00:00","first_seen_at":"2026-11-13T10:47:20+00:00","triaged_at":"2026-11-13T10:56:56+00:00","updated_at":"2026-11-13T10:56:56+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-13T10:56:56Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR `8.5.0` (fixed in releases before 8.5.0 as stated by the source)","reach":"network","title":"OpenEMR: any logged-in staff can sign and lock other patients' forms","impact":"medium","summary":"OpenEMR's electronic signature handler checks only the caller's password, not whether they may access the patient, encounter or form. An authenticated core user can sign and lock any patient's clinical form, creating false approval records and blocking normal editing.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","self-hosted","healthcare"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated user falsely signs and locks any patient's clinical form","analyst_note":"","how_to_check":"- Check the installed OpenEMR version (`version` in the OpenEMR config or admin footer); versions below `8.5.0` are listed as affected.\n- Look for `library/ESign/Form/Controller.php` in the install and review the `esign_form_submit` handler.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-8.5.0-or-later","no-user-accounts"],"who_is_affected":"Any OpenEMR deployment before 8.5.0 where core users have accounts. The flaw is in the electronic signature path, so sites that do not use e-signing on forms are still exposed through the handler, but exposure requires a valid login. Sites on 8.5.0 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000745,"input_tokens":4636,"output_tokens":562,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126419':16A,19A '-2026':15A,18A '8.5.0':70C 'access':41B,92C 'approv':62B,122C 'arbitrari':105C 'authent':48B,100C 'author':74C 'block':65B,125C 'caller':34B,88C 'check':31B 'clinic':58B,118C 'contain':71C 'core':49B,101C 'creat':60B,120C 'cve':14A,17A 'edit':67B,127C 'electron':28B 'encount':44B,96C 'encounterid':109C 'esign':78C 'fals':61B 'form':13A,46B,59B,79C,98C,119C 'formdir':107C 'formid':106C 'handler':30B,81C 'healthcar':20B 'host':25B 'library/esign/form/controller.php':83C 'lock':10A,54B,114C 'log':4A 'logged-in':3A 'may':40B 'miss':73C 'normal':66B,126C 'openemr':1A,21B,26B,68C 'password':36B,90C 'patient':12A,43B,56B,95C,116C 'record':63B,123C 'runtim':22B 'self':24B 'self-host':23B 'sign':8A,52B,112C 'signatur':29B 'staff':6A 'submit':80C 'suppli':104C 'type':99C 'unauthor':121C 'user':50B,102C 'valu':110C 'verifi':85C 'vulner':75C 'whether':38B","nicknames":[],"mitigations":[],"who_affected":"Any OpenEMR deployment before 8.5.0 where core users have accounts. The flaw is in the electronic signature path, so sites that do not use e-signing on forms are still exposed through the handler, but exposure requires a valid login. Sites on 8.5.0 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","medium","openemr","runtime","selfhosted"],"campaign_type":null,"search_a":"'-126419':16A,19A '-2026':15A,18A 'cve':14A,17A 'form':13A 'lock':10A 'log':4A 'logged-in':3A 'openemr':1A 'patient':12A 'sign':8A 'staff':6A","search_b":"'access':41B 'approv':62B 'authent':48B 'block':65B 'caller':34B 'check':31B 'clinic':58B 'core':49B 'creat':60B 'edit':67B 'electron':28B 'encount':44B 'fals':61B 'form':46B,59B 'handler':30B 'healthcar':20B 'host':25B 'lock':54B 'may':40B 'normal':66B 'openemr':21B,26B 'password':36B 'patient':43B,56B 'record':63B 'runtim':22B 'self':24B 'self-host':23B 'sign':52B 'signatur':29B 'user':50B 'whether':38B","search_c":"'8.5.0':70C 'access':92C 'approv':122C 'arbitrari':105C 'authent':100C 'author':74C 'block':125C 'caller':88C 'clinic':118C 'contain':71C 'core':101C 'creat':120C 'edit':127C 'encount':96C 'encounterid':109C 'esign':78C 'form':79C,98C,119C 'formdir':107C 'formid':106C 'handler':81C 'library/esign/form/controller.php':83C 'lock':114C 'miss':73C 'normal':126C 'openemr':68C 'password':90C 'patient':95C,116C 'record':123C 'sign':112C 'submit':80C 'suppli':104C 'type':99C 'unauthor':121C 'user':102C 'valu':110C 'verifi':85C 'vulner':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T02:14:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126419","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126419","severity":null,"published_at":"2026-11-13T10:17:47+00:00","modified_at":"2026-11-13T10:17:47+00:00","first_seen_at":"2026-11-13T10:47:20+00:00","fetched_at":"2026-11-13T10:47:20+00:00","note":null}],"documents":[{"id":145081,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-6x2w-9gwv-mc7v","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T02:14:54+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145082,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-e-sign-form-submission","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}