CVE-2026-126424 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 lets a user with admin or superbill write permission store HTML in SNOMED code descriptions. When a clinician selects that code in certain forms, the script runs in their session and can read patient data and perform actions.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Clinics and hospitals running OpenEMR older than 8.5.0 where users hold admin or superbill write permission. The exposure is internal: an attacker needs such an account, and clinicians who select the poisoned SNOMED code are the ones who run the script. Installations already on 8.5.0 or later are not affected.
Not affected if no-superbill-write-users, openemr-8.5.0-or-later
Who cares healthcare, openemr, self-hosted
8.5.0 are listed as affected8.5.0 or laterOpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows users with admin/superbill write permission to inject HTML into SNOMED code descriptions via superbill_custom_full.php. When a clinician selects the malicious code, the Functional and Cognitive Status form or fee-sheet forms assign it to innerHTML, executing JavaScript in the clinician's session to read patient data and perform actions.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.