---
id: "CVE-2026-126422"
page: "https://infrastack.ai/live/CVE-2026-126422"
kind: "vulnerability"
aliases: ["CVE-2026-126422"]
title: "OpenEMR: restricted users can falsely mark other patients' clinical lists reviewed"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["healthcare", "openemr", "other", "self-hosted"]
not_affected_if: ["version-8.5.0-or-later"]
published_at: "2026-11-13T10:17:48+00:00"
first_seen_at: "2026-11-13T10:47:21+00:00"
updated_at: "2026-11-13T10:57:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126422", "first_seen_at": "2026-11-13T10:47:21+00:00"}]
exploit_sources: []
---

# OpenEMR: restricted users can falsely mark other patients' clinical lists reviewed

Link for people: https://infrastack.ai/live/CVE-2026-126422 (this .md is for agents)

OpenEMR before 8.5.0 lets a restricted logged-in user mark another patient's allergy, medication, or problem lists as reviewed by submitting arbitrary patient and type values. An attacker can record false "None known" entries, misleading clinicians and skewing quality measures.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenEMR version in the installation's footer or `version.php` and compare it with `8.5.0`.
- Review whether restricted or low-privilege user accounts can reach `library/ajax/lists_touch.php`.

## Fix

- OpenEMR: upgrade to `8.5.0` or later (fixed version per NVD description: before 8.5.0 is affected).

## Timeline

- 2026-11-13T10:47:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126422

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openemr/openemr/security/advisories/GHSA-924r-c6jp-67px
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-lists-touch-php

## From the sources

OpenEMR before 8.5.0 contains a missing authorization vulnerability in library/ajax/lists_touch.php that allows restricted authenticated users to mark another patient's clinical lists as reviewed. Attackers can submit arbitrary patient_id and type values to falsely record "None known" allergy, medication, or problem lists, misleading clinicians and skewing quality-measure calculations.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_