---
id: "CVE-2026-126430"
page: "https://infrastack.ai/live/CVE-2026-126430"
kind: "vulnerability"
aliases: ["CVE-2026-126430"]
title: "OpenEMR: SQL injection lets any staff user read password hashes"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "OpenEMR", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["healthcare", "openemr", "php", "runtime", "self-hosted"]
not_affected_if: ["openemr-8.5.0-or-later"]
published_at: "2026-11-13T10:17:49+00:00"
first_seen_at: "2026-11-13T10:47:21+00:00"
updated_at: "2026-11-13T10:50:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126430", "first_seen_at": "2026-11-13T10:47:21+00:00"}]
exploit_sources: []
---

# OpenEMR: SQL injection lets any staff user read password hashes

Link for people: https://infrastack.ai/live/CVE-2026-126430 (this .md is for agents)

OpenEMR, an electronic health records system, has an SQL injection flaw in its CCR revandapprove controller that any authenticated core user can trigger by supplying crafted patient_data field names. An attacker can read staff password hashes and patient-portal reset values, alter patient demographics, and take over patient-portal accounts.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:OpenEMR affected range not listed fixed no fixed version listed

## How to check

- Check the installed OpenEMR version in the application's version file or admin footer and compare it with the fixed release.

## Fix

- OpenEMR: move to `8.5.0` or later (fixed release named in the advisory range: before 8.5.0).

## Timeline

- 2026-11-13T10:47:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126430

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openemr/openemr/security/advisories/GHSA-wh28-4qcg-5hcc
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-ccr-revandapprove-field-names

## From the sources

OpenEMR before 8.5.0 contains an sql injection vulnerability that allows any authenticated core user to inject SQL by supplying crafted patient_data field names to the CCR revandapprove controller. Attackers can embed scalar subqueries in the UPDATE patient_data SET clause to read staff password hashes and portal reset values, alter arbitrary patient demographics, and take over patient-portal accounts.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_