CVE-2026-126422 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 lets a restricted logged-in user mark another patient's allergy, medication, or problem lists as reviewed by submitting arbitrary patient and type values. An attacker can record false "None known" entries, misleading clinicians and skewing quality measures.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Clinics and hospitals running self-hosted OpenEMR before 8.5.0 with restricted authenticated user roles are exposed, because the missing authorization check lets those users modify other patients' records. Installations with only fully trusted staff accounts face lower practical risk but should still upgrade.
Not affected if version-8.5.0-or-later
Who cares healthcare, openemr, self-hosted
version.php and compare it with 8.5.0.library/ajax/lists_touch.php.8.5.0 or later (fixed version per NVD description: before 8.5.0 is affected).OpenEMR before 8.5.0 contains a missing authorization vulnerability in library/ajax/lists_touch.php that allows restricted authenticated users to mark another patient's clinical lists as reviewed. Attackers can submit arbitrary patient_id and type values to falsely record "None known" allergy, medication, or problem lists, misleading clinicians and skewing quality-measure calculations.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.