CVE-2026-126432 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 lets a logged-in user with read-only rights send lab orders to laboratories, because a permission check in the orders report page ignores write permission. The HL7 orders carry patient SSNs, insurance and diagnoses, and the attacker can mark them as transmitted.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
OpenEMR installations before 8.5.0 where users with read-only permissions have accounts. The flaw requires an authenticated session, so instances without shared or low-privilege accounts face less exposure. unknown whether other configurations change exposure.
Not affected if no-read-only-users, openemr-8.5.0-or-later
Who cares healthcare, hl7, lab-orders, openemr
8.5.0 or later is not affected by this entry.interface/orders/list_reports.php.8.5.0 or later.OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/list_reports.php that allows read-only users to transmit lab orders because the patients/med check ignores write permission. Authenticated attackers can submit form_xmit with arbitrary procedure order IDs to send HL7 orders containing SSNs, insurance, and diagnoses to laboratories and mark them transmitted.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.