{"id":"CVE-2026-126431","kind":"vulnerability","aliases":["CVE-2026-126431"],"related":[],"title":"OpenEMR: stored SQL injection through C-CDA field identifiers leaks patient records","description":"OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows authenticated Carecoordination users to store malicious C-CDA field identifiers through the savedata action. Attackers can inject SQL into the IN clause built by fetchFormValues() during C-CDA generation to extract password hashes, portal reset values, and patient records.","summary":"OpenEMR before 8.5.0 lets an authenticated Carecoordination user store malicious C-CDA field identifiers through the savedata action. When C-CDA generation later builds an IN clause from them, the stored input runs as SQL, so an attacker can extract password hashes, portal reset values and patient records.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","runtime","self-hosted"],"not_affected_if":["no-carecoordination-users","version-8.5.0-or-later"],"how_to_check":"- Check the OpenEMR version in the installed application; affected versions are those before `8.5.0`.","fix":"- OpenEMR: move to `8.5.0` or later (the sources state the fix is in versions before `8.5.0` being affected).","status":"open","published_at":"2026-11-13T10:17:49+00:00","first_seen_at":"2026-11-13T10:47:22+00:00","triaged_at":"2026-11-13T10:52:38+00:00","updated_at":"2026-11-13T10:52:38+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-13T10:52:38Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.5.0` or later (the sources state the fix is in versions before `8.5.0` being affected).","reach":"internet","title":"OpenEMR: stored SQL injection through C-CDA field identifiers leaks patient records","impact":"high","summary":"OpenEMR before 8.5.0 lets an authenticated Carecoordination user store malicious C-CDA field identifiers through the savedata action. When C-CDA generation later builds an IN clause from them, the stored input runs as SQL, so an attacker can extract password hashes, portal reset values and patient records.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","healthcare","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"attacker reads password hashes and patient records from the database","analyst_note":"Confirm the exact affected range and whether it applies to all OpenEMR deployments; check the vendor advisory on github.com and the vulncheck.com advisory for detection guidance.","how_to_check":"- Check the OpenEMR version in the installed application; affected versions are those before `8.5.0`.\n- unknown for other checks; the sources do not describe a specific file or setting to inspect.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-8.5.0-or-later","no-carecoordination-users"],"who_is_affected":"OpenEMR installations before 8.5.0 that have users with the Carecoordination role, since that role can save the malicious C-CDA field identifiers. Installations on 8.5.0 or later are not affected by this flaw, and the attacker must hold a valid authenticated account first.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000772,"input_tokens":4615,"output_tokens":622,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126431':16A,19A '-2026':15A,18A '8.5.0':28B,78C 'action':44B,103C 'allow':88C 'attack':65B,104C 'authent':31B,89C 'build':51B 'built':112C 'c':7A,37B,47B,96C,117C 'c-cda':6A,36B,46B,95C,116C 'carecoordin':32B,90C 'cda':8A,38B,48B,97C,118C 'claus':54B,111C 'contain':79C 'cve':14A,17A 'extract':67B,121C 'fetchformvalu':114C 'field':9A,39B,98C 'generat':49B,119C 'hash':69B,123C 'healthcar':20B 'host':25B 'identifi':10A,40B,99C 'inject':4A,85C,106C 'input':59B 'later':50B 'leak':11A 'let':29B 'malici':35B,94C 'openemr':1A,21B,26B,76C 'order':83C 'password':68B,122C 'patient':12A,74B,128C 'portal':70B,124C 'record':13A,75B,129C 'reset':71B,125C 'run':60B 'runtim':22B 'savedata':43B,102C 'second':82C 'second-ord':81C 'self':24B 'self-host':23B 'sql':3A,62B,84C,107C 'store':2A,34B,58B,93C 'user':33B,91C 'valu':72B,126C 'vulner':86C","nicknames":[],"mitigations":[],"who_affected":"OpenEMR installations before 8.5.0 that have users with the Carecoordination role, since that role can save the malicious C-CDA field identifiers. Installations on 8.5.0 or later are not affected by this flaw, and the attacker must hold a valid authenticated account first.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","runtime","selfhosted"],"campaign_type":null,"search_a":"'-126431':16A,19A '-2026':15A,18A 'c':7A 'c-cda':6A 'cda':8A 'cve':14A,17A 'field':9A 'identifi':10A 'inject':4A 'leak':11A 'openemr':1A 'patient':12A 'record':13A 'sql':3A 'store':2A","search_b":"'8.5.0':28B 'action':44B 'attack':65B 'authent':31B 'build':51B 'c':37B,47B 'c-cda':36B,46B 'carecoordin':32B 'cda':38B,48B 'claus':54B 'extract':67B 'field':39B 'generat':49B 'hash':69B 'healthcar':20B 'host':25B 'identifi':40B 'input':59B 'later':50B 'let':29B 'malici':35B 'openemr':21B,26B 'password':68B 'patient':74B 'portal':70B 'record':75B 'reset':71B 'run':60B 'runtim':22B 'savedata':43B 'self':24B 'self-host':23B 'sql':62B 'store':34B,58B 'user':33B 'valu':72B","search_c":"'8.5.0':78C 'action':103C 'allow':88C 'attack':104C 'authent':89C 'built':112C 'c':96C,117C 'c-cda':95C,116C 'carecoordin':90C 'cda':97C,118C 'claus':111C 'contain':79C 'extract':121C 'fetchformvalu':114C 'field':98C 'generat':119C 'hash':123C 'identifi':99C 'inject':85C,106C 'malici':94C 'openemr':76C 'order':83C 'password':122C 'patient':128C 'portal':124C 'record':129C 'reset':125C 'savedata':102C 'second':82C 'second-ord':81C 'sql':84C,107C 'store':93C 'user':91C 'valu':126C 'vulner':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:41:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126431","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126431","severity":null,"published_at":"2026-11-13T10:17:49+00:00","modified_at":"2026-11-13T10:17:49+00:00","first_seen_at":"2026-11-13T10:47:22+00:00","fetched_at":"2026-11-13T10:47:22+00:00","note":null}],"documents":[{"id":145106,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-8rgh-38j4-6pxf","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:41:37+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145107,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-second-order-sql-injection-via-carecoordination-ccda-mapper","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}