OPENEMR · CVE-2026-126430 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR, an electronic health records system, has an SQL injection flaw in its CCR revandapprove controller that any authenticated core user can trigger by supplying crafted patient_data field names. An attacker can read staff password hashes and patient-portal reset values, alter patient demographics, and take over patient-portal accounts.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any OpenEMR deployment before 8.5.0 where at least one authenticated core user exists is exposed, since the flaw is reached through the CCR revandapprove controller. Instances that are not running OpenEMR, or are already on 8.5.0 or later, can skip it. Sources do not say whether managed hosting changes exposure.
Not affected if openemr-8.5.0-or-later
Who cares healthcare, openemr, php, self-hosted
8.5.0 or later (fixed release named in the advisory range: before 8.5.0).OpenEMR before 8.5.0 contains an sql injection vulnerability that allows any authenticated core user to inject SQL by supplying crafted patient_data field names to the CCR revandapprove controller. Attackers can embed scalar subqueries in the UPDATE patient_data SET clause to read staff password hashes and portal reset values, alter arbitrary patient demographics, and take over patient-portal accounts.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.