CVE-2026-126434 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 fails to check the patients/lab permission in its procedure order form, so any logged-in account can view and change other patients' procedure orders. An attacker can read clinical history or falsify diagnoses, instructions and order status.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Clinics and hospitals that run OpenEMR on their own servers and let staff log in with accounts that lack lab permissions. Installations on managed hosting still need the version check, since the flaw sits in the application code. unknown on whether hosted OpenEMR vendors have already patched.
Not affected if version-8.5.0-or-later
Who cares healthcare, openemr, self-hosted
version in version.php or the admin footer); versions below 8.5.0 are affected.interface/forms/procedure_order/common.php is present and reachable by authenticated users.8.5.0 or later.OpenEMR before 8.5.0 contains a missing authorization vulnerability in interface/forms/procedure_order/common.php that allows authenticated accounts lacking patients/lab permission to read and modify other patients' procedure orders. Attackers can request a global order id to disclose clinical history, or select the target patient in their session and submit bn_save to falsify diagnoses, instructions, and order status.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.