{"id":"CVE-2026-126430","kind":"vulnerability","aliases":["CVE-2026-126430"],"related":[],"title":"OpenEMR: SQL injection lets any staff user read password hashes","description":"OpenEMR before 8.5.0 contains an sql injection vulnerability that allows any authenticated core user to inject SQL by supplying crafted patient_data field names to the CCR revandapprove controller. Attackers can embed scalar subqueries in the UPDATE patient_data SET clause to read staff password hashes and portal reset values, alter arbitrary patient demographics, and take over patient-portal accounts.","summary":"OpenEMR, an electronic health records system, has an SQL injection flaw in its CCR revandapprove controller that any authenticated core user can trigger by supplying crafted patient_data field names. An attacker can read staff password hashes and patient-portal reset values, alter patient demographics, and take over patient-portal accounts.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OpenEMR","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["healthcare","openemr","php","runtime","self-hosted"],"not_affected_if":["openemr-8.5.0-or-later"],"how_to_check":"- Check the installed OpenEMR version in the application's version file or admin footer and compare it with the fixed release.","fix":"- OpenEMR: move to `8.5.0` or later (fixed release named in the advisory range: before 8.5.0).","status":"open","published_at":"2026-11-13T10:17:49+00:00","first_seen_at":"2026-11-13T10:47:21+00:00","triaged_at":"2026-11-13T10:50:49+00:00","updated_at":"2026-11-13T10:50:49+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-13T10:50:49Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.5.0` or later (fixed release named in the advisory range: before 8.5.0).","reach":"network","title":"OpenEMR: SQL injection lets any staff user read password hashes","impact":"high","summary":"OpenEMR, an electronic health records system, has an SQL injection flaw in its CCR revandapprove controller that any authenticated core user can trigger by supplying crafted patient_data field names. An attacker can read staff password hashes and patient-portal reset values, alter patient demographics, and take over patient-portal accounts.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","php"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Staff password hashes read, patient records altered, portal accounts taken over","analyst_note":"Confirm the affected version range and the exact fixed release from the vendor advisory at github.com and the VulnCheck advisory.","how_to_check":"- Check the installed OpenEMR version in the application's version file or admin footer and compare it with the fixed release.\n- unknown for any other check; the sources do not name a configuration to inspect.","plain_action":"","product_name":"OpenEMR","needs_analyst":true,"not_affected_if":["openemr-8.5.0-or-later"],"who_is_affected":"Any OpenEMR deployment before 8.5.0 where at least one authenticated core user exists is exposed, since the flaw is reached through the CCR revandapprove controller. Instances that are not running OpenEMR, or are already on 8.5.0 or later, can skip it. Sources do not say whether managed hosting changes exposure.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000782,"input_tokens":4634,"output_tokens":637,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126430':13A,16A '-2026':12A,15A '8.5.0':80C 'account':77B,138C 'allow':87C 'alter':68B,128C 'arbitrari':129C 'attack':56B,107C 'authent':43B,89C 'ccr':38B,104C 'claus':118C 'contain':81C 'control':40B,106C 'core':44B,90C 'craft':50B,97C 'cve':11A,14A 'data':52B,99C,116C 'demograph':70B,131C 'electron':27B 'emb':109C 'field':53B,100C 'flaw':35B 'hash':10A,61B,123C 'health':28B 'healthcar':18B 'host':24B 'inject':3A,34B,84C,93C 'let':4A 'name':54B,101C 'openemr':1A,17A,19B,25B,78C 'password':9A,60B,122C 'patient':51B,64B,69B,75B,98C,115C,130C,136C 'patient-port':63B,74B,135C 'php':20B 'portal':65B,76B,125C,137C 'read':8A,58B,120C 'record':29B 'reset':66B,126C 'revandapprov':39B,105C 'runtim':21B 'scalar':110C 'self':23B 'self-host':22B 'set':117C 'sql':2A,33B,83C,94C 'staff':6A,59B,121C 'subqueri':111C 'suppli':49B,96C 'system':30B 'take':72B,133C 'trigger':47B 'updat':114C 'user':7A,45B,91C 'valu':67B,127C 'vulner':85C","nicknames":[],"mitigations":[],"who_affected":"Any OpenEMR deployment before 8.5.0 where at least one authenticated core user exists is exposed, since the flaw is reached through the CCR revandapprove controller. Instances that are not running OpenEMR, or are already on 8.5.0 or later, can skip it. Sources do not say whether managed hosting changes exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["openemr"],"ptokens":["openemr"],"labels":["healthcare","high","openemr","php","runtime","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126430':13A,16A '-2026':12A,15A 'cve':11A,14A 'hash':10A 'inject':3A 'let':4A 'openemr':1A,17A 'password':9A 'read':8A 'sql':2A 'staff':6A 'user':7A","search_b":"'account':77B 'alter':68B 'attack':56B 'authent':43B 'ccr':38B 'control':40B 'core':44B 'craft':50B 'data':52B 'demograph':70B 'electron':27B 'field':53B 'flaw':35B 'hash':61B 'health':28B 'healthcar':18B 'host':24B 'inject':34B 'name':54B 'openemr':19B,25B 'password':60B 'patient':51B,64B,69B,75B 'patient-port':63B,74B 'php':20B 'portal':65B,76B 'read':58B 'record':29B 'reset':66B 'revandapprov':39B 'runtim':21B 'self':23B 'self-host':22B 'sql':33B 'staff':59B 'suppli':49B 'system':30B 'take':72B 'trigger':47B 'user':45B 'valu':67B","search_c":"'8.5.0':80C 'account':138C 'allow':87C 'alter':128C 'arbitrari':129C 'attack':107C 'authent':89C 'ccr':104C 'claus':118C 'contain':81C 'control':106C 'core':90C 'craft':97C 'data':99C,116C 'demograph':131C 'emb':109C 'field':100C 'hash':123C 'inject':84C,93C 'name':101C 'openemr':78C 'password':122C 'patient':98C,115C,130C,136C 'patient-port':135C 'portal':125C,137C 'read':120C 'reset':126C 'revandapprov':105C 'scalar':110C 'set':117C 'sql':83C,94C 'staff':121C 'subqueri':111C 'suppli':96C 'take':133C 'updat':114C 'user':91C 'valu':127C 'vulner':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:40:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126430","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126430","severity":null,"published_at":"2026-11-13T10:17:49+00:00","modified_at":"2026-11-13T10:17:49+00:00","first_seen_at":"2026-11-13T10:47:21+00:00","fetched_at":"2026-11-13T10:47:21+00:00","note":null}],"documents":[{"id":145104,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-wh28-4qcg-5hcc","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:40:51+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145105,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-ccr-revandapprove-field-names","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}