{"id":"CVE-2026-126422","kind":"vulnerability","aliases":["CVE-2026-126422"],"related":[],"title":"OpenEMR: restricted users can falsely mark other patients' clinical lists reviewed","description":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in library/ajax/lists_touch.php that allows restricted authenticated users to mark another patient's clinical lists as reviewed. Attackers can submit arbitrary patient_id and type values to falsely record \"None known\" allergy, medication, or problem lists, misleading clinicians and skewing quality-measure calculations.","summary":"OpenEMR before 8.5.0 lets a restricted logged-in user mark another patient's allergy, medication, or problem lists as reviewed by submitting arbitrary patient and type values. An attacker can record false \"None known\" entries, misleading clinicians and skewing quality measures.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","other","self-hosted"],"not_affected_if":["version-8.5.0-or-later"],"how_to_check":"- Check the OpenEMR version in the installation's footer or `version.php` and compare it with `8.5.0`.\n- Review whether restricted or low-privilege user accounts can reach `library/ajax/lists_touch.php`.","fix":"- OpenEMR: upgrade to `8.5.0` or later (fixed version per NVD description: before 8.5.0 is affected).","status":"open","published_at":"2026-11-13T10:17:48+00:00","first_seen_at":"2026-11-13T10:47:21+00:00","triaged_at":"2026-11-13T10:57:18+00:00","updated_at":"2026-11-13T10:57:18+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T10:57:18Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: upgrade to `8.5.0` or later (fixed version per NVD description: before 8.5.0 is affected).","reach":"network","title":"OpenEMR: restricted users can falsely mark other patients' clinical lists reviewed","impact":"medium","summary":"OpenEMR before 8.5.0 lets a restricted logged-in user mark another patient's allergy, medication, or problem lists as reviewed by submitting arbitrary patient and type values. An attacker can record false \"None known\" entries, misleading clinicians and skewing quality measures.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","self-hosted","healthcare"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Falsified clinical list records for other patients, misleading clinicians","analyst_note":"","how_to_check":"- Check the OpenEMR version in the installation's footer or `version.php` and compare it with `8.5.0`.\n- Review whether restricted or low-privilege user accounts can reach `library/ajax/lists_touch.php`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-8.5.0-or-later"],"who_is_affected":"Clinics and hospitals running self-hosted OpenEMR before 8.5.0 with restricted authenticated user roles are exposed, because the missing authorization check lets those users modify other patients' records. Installations with only fully trusted staff accounts face lower practical risk but should still upgrade.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000748,"input_tokens":4631,"output_tokens":569,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126422':14A,17A '-2026':13A,16A '8.5.0':26B,68C 'allergi':38B,104C 'allow':77C 'anoth':35B,83C 'arbitrari':47B,93C 'attack':53B,90C 'authent':79C 'author':72C 'calcul':116C 'clinic':9A,86C 'clinician':61B,110C 'contain':69C 'cve':12A,15A 'entri':59B 'fals':5A,56B,100C 'healthcar':18B 'host':23B 'id':95C 'known':58B,103C 'let':27B 'library/ajax/lists_touch.php':75C 'list':10A,42B,87C,108C 'log':31B 'logged-in':30B 'mark':6A,34B,82C 'measur':65B,115C 'medic':39B,105C 'mislead':60B,109C 'miss':71C 'none':57B,102C 'openemr':1A,19B,24B,66C 'patient':8A,36B,48B,84C,94C 'problem':41B,107C 'qualiti':64B,114C 'quality-measur':113C 'record':55B,101C 'restrict':2A,29B,78C 'review':11A,44B,89C 'self':22B 'self-host':21B 'skew':63B,112C 'submit':46B,92C 'type':50B,97C 'user':3A,33B,80C 'valu':51B,98C 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"Clinics and hospitals running self-hosted OpenEMR before 8.5.0 with restricted authenticated user roles are exposed, because the missing authorization check lets those users modify other patients' records. Installations with only fully trusted staff accounts face lower practical risk but should still upgrade.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","medium","openemr","other","selfhosted"],"campaign_type":null,"search_a":"'-126422':14A,17A '-2026':13A,16A 'clinic':9A 'cve':12A,15A 'fals':5A 'list':10A 'mark':6A 'openemr':1A 'patient':8A 'restrict':2A 'review':11A 'user':3A","search_b":"'8.5.0':26B 'allergi':38B 'anoth':35B 'arbitrari':47B 'attack':53B 'clinician':61B 'entri':59B 'fals':56B 'healthcar':18B 'host':23B 'known':58B 'let':27B 'list':42B 'log':31B 'logged-in':30B 'mark':34B 'measur':65B 'medic':39B 'mislead':60B 'none':57B 'openemr':19B,24B 'patient':36B,48B 'problem':41B 'qualiti':64B 'record':55B 'restrict':29B 'review':44B 'self':22B 'self-host':21B 'skew':63B 'submit':46B 'type':50B 'user':33B 'valu':51B","search_c":"'8.5.0':68C 'allergi':104C 'allow':77C 'anoth':83C 'arbitrari':93C 'attack':90C 'authent':79C 'author':72C 'calcul':116C 'clinic':86C 'clinician':110C 'contain':69C 'fals':100C 'id':95C 'known':103C 'library/ajax/lists_touch.php':75C 'list':87C,108C 'mark':82C 'measur':115C 'medic':105C 'mislead':109C 'miss':71C 'none':102C 'openemr':66C 'patient':84C,94C 'problem':107C 'qualiti':114C 'quality-measur':113C 'record':101C 'restrict':78C 'review':89C 'skew':112C 'submit':92C 'type':97C 'user':80C 'valu':98C 'vulner':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T02:16:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126422","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126422","severity":null,"published_at":"2026-11-13T10:17:48+00:00","modified_at":"2026-11-13T10:17:48+00:00","first_seen_at":"2026-11-13T10:47:21+00:00","fetched_at":"2026-11-13T10:47:21+00:00","note":null}],"documents":[{"id":145087,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-924r-c6jp-67px","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T02:16:45+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145088,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-lists-touch-php","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}