{"id":"CVE-2026-126433","kind":"vulnerability","aliases":["CVE-2026-126433"],"related":[],"title":"OpenEMR: read-only drug users can record fake medication dispenses","description":"OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/drugs/dispense_drug.php, which checks only for admin/drugs view permission instead of write permission before dispensing medication. Authenticated users with read-only drug administration access can send GET requests with drug_id, quantity, fee, and encounter parameters to create false dispensing records and decrement inventory.","summary":"OpenEMR before 8.5.0 checks only drug view permission in its dispense page, so users with read-only drug access can record fake dispensing events. An attacker can create false dispensing records and reduce drug inventory counts.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","other","self-hosted"],"not_affected_if":["no-read-only-drug-users","openemr-8.5.0-or-later"],"how_to_check":"- Check the OpenEMR version in the installed application: `unknown` command not given by sources\n- Confirm whether users with read-only drug administration access exist in the admin permission settings","fix":"- OpenEMR: `8.5.0` or later","status":"open","published_at":"2026-11-13T10:17:50+00:00","first_seen_at":"2026-11-13T10:47:22+00:00","triaged_at":"2026-11-13T10:56:39+00:00","updated_at":"2026-11-13T10:56:39+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T10:56:39Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: `8.5.0` or later","reach":"network","title":"OpenEMR: read-only drug users can record fake medication dispenses","impact":"medium","summary":"OpenEMR before 8.5.0 checks only drug view permission in its dispense page, so users with read-only drug access can record fake dispensing events. An attacker can create false dispensing records and reduce drug inventory counts.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","healthcare","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"False dispensing records created and drug inventory falsified by read-only users","analyst_note":"Confirm the exact vulnerable version range and the patch details at the vendor advisory on github.com and the vulncheck page.","how_to_check":"- Check the OpenEMR version in the installed application: `unknown` command not given by sources\n- Confirm whether users with read-only drug administration access exist in the admin permission settings","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["openemr-8.5.0-or-later","no-read-only-drug-users"],"who_is_affected":"Clinics and hospitals running OpenEMR versions before 8.5.0 where staff hold read-only drug administration permissions. The flaw needs a logged-in account, so installations with no such users have less exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000723,"input_tokens":4630,"output_tokens":519,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126433':14A,17A '-2026':13A,16A '8.5.0':26B,63C 'access':43B,93C 'admin/drugs':75C 'administr':92C 'attack':50B 'authent':85C 'author':67C 'check':27B,72C 'contain':64C 'count':60B 'creat':52B,107C 'cve':12A,15A 'decrement':112C 'dispens':11A,34B,47B,54B,83C,109C 'drug':5A,29B,42B,58B,91C,99C 'encount':104C 'event':48B 'fake':9A,46B 'fals':53B,108C 'fee':102C 'get':96C 'healthcar':18B 'host':23B 'id':100C 'improp':66C 'instead':78C 'interface/drugs/dispense_drug.php':70C 'inventori':59B,113C 'medic':10A,84C 'openemr':1A,19B,24B,61C 'page':35B 'paramet':105C 'permiss':31B,77C,81C 'quantiti':101C 'read':3A,40B,89C 'read-on':2A,39B,88C 'record':8A,45B,55B,110C 'reduc':57B 'request':97C 'self':22B 'self-host':21B 'send':95C 'user':6A,37B,86C 'view':30B,76C 'vulner':68C 'write':80C","nicknames":[],"mitigations":[],"who_affected":"Clinics and hospitals running OpenEMR versions before 8.5.0 where staff hold read-only drug administration permissions. The flaw needs a logged-in account, so installations with no such users have less exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","medium","openemr","other","selfhosted"],"campaign_type":null,"search_a":"'-126433':14A,17A '-2026':13A,16A 'cve':12A,15A 'dispens':11A 'drug':5A 'fake':9A 'medic':10A 'openemr':1A 'read':3A 'read-on':2A 'record':8A 'user':6A","search_b":"'8.5.0':26B 'access':43B 'attack':50B 'check':27B 'count':60B 'creat':52B 'dispens':34B,47B,54B 'drug':29B,42B,58B 'event':48B 'fake':46B 'fals':53B 'healthcar':18B 'host':23B 'inventori':59B 'openemr':19B,24B 'page':35B 'permiss':31B 'read':40B 'read-on':39B 'record':45B,55B 'reduc':57B 'self':22B 'self-host':21B 'user':37B 'view':30B","search_c":"'8.5.0':63C 'access':93C 'admin/drugs':75C 'administr':92C 'authent':85C 'author':67C 'check':72C 'contain':64C 'creat':107C 'decrement':112C 'dispens':83C,109C 'drug':91C,99C 'encount':104C 'fals':108C 'fee':102C 'get':96C 'id':100C 'improp':66C 'instead':78C 'interface/drugs/dispense_drug.php':70C 'inventori':113C 'medic':84C 'openemr':61C 'paramet':105C 'permiss':77C,81C 'quantiti':101C 'read':89C 'read-on':88C 'record':110C 'request':97C 'send':95C 'user':86C 'view':76C 'vulner':68C 'write':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:49:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126433","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126433","severity":null,"published_at":"2026-11-13T10:17:50+00:00","modified_at":"2026-11-13T10:17:50+00:00","first_seen_at":"2026-11-13T10:47:22+00:00","fetched_at":"2026-11-13T10:47:22+00:00","note":null}],"documents":[{"id":145110,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-hp8p-h8g8-xmg3","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:49:18+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145111,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-improper-authorization-via-dispense-drug-php","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}