CVE-2026-126433 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 checks only drug view permission in its dispense page, so users with read-only drug access can record fake dispensing events. An attacker can create false dispensing records and reduce drug inventory counts.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Clinics and hospitals running OpenEMR versions before 8.5.0 where staff hold read-only drug administration permissions. The flaw needs a logged-in account, so installations with no such users have less exposure.
Not affected if no-read-only-drug-users, openemr-8.5.0-or-later
Who cares healthcare, openemr, self-hosted
unknown command not given by sources8.5.0 or laterOpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/drugs/dispense_drug.php, which checks only for admin/drugs view permission instead of write permission before dispensing medication. Authenticated users with read-only drug administration access can send GET requests with drug_id, quantity, fee, and encounter parameters to create false dispensing records and decrement inventory.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.