{"id":"CVE-2026-126434","kind":"vulnerability","aliases":["CVE-2026-126434"],"related":[],"title":"OpenEMR: missing permission check exposes and alters other patients' lab orders","description":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in interface/forms/procedure_order/common.php that allows authenticated accounts lacking patients/lab permission to read and modify other patients' procedure orders. Attackers can request a global order id to disclose clinical history, or select the target patient in their session and submit bn_save to falsify diagnoses, instructions, and order status.","summary":"OpenEMR before 8.5.0 fails to check the patients/lab permission in its procedure order form, so any logged-in account can view and change other patients' procedure orders. An attacker can read clinical history or falsify diagnoses, instructions and order status.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","runtime","self-hosted"],"not_affected_if":["version-8.5.0-or-later"],"how_to_check":"- Check the installed OpenEMR version (`version` in `version.php` or the admin footer); versions below `8.5.0` are affected.\n- Confirm whether `interface/forms/procedure_order/common.php` is present and reachable by authenticated users.","fix":"- OpenEMR: move to `8.5.0` or later.","status":"open","published_at":"2026-11-13T10:17:50+00:00","first_seen_at":"2026-11-13T10:47:22+00:00","triaged_at":"2026-11-13T10:50:48+00:00","updated_at":"2026-11-13T10:50:48+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-13T10:50:48Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.5.0` or later.","reach":"network","title":"OpenEMR: missing permission check exposes and alters other patients' lab orders","impact":"high","summary":"OpenEMR before 8.5.0 fails to check the patients/lab permission in its procedure order form, so any logged-in account can view and change other patients' procedure orders. An attacker can read clinical history or falsify diagnoses, instructions and order status.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","self-hosted","healthcare"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Other patients' lab orders read and falsified, exposing clinical data","analyst_note":"","how_to_check":"- Check the installed OpenEMR version (`version` in `version.php` or the admin footer); versions below `8.5.0` are affected.\n- Confirm whether `interface/forms/procedure_order/common.php` is present and reachable by authenticated users.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-8.5.0-or-later"],"who_is_affected":"Clinics and hospitals that run OpenEMR on their own servers and let staff log in with accounts that lack lab permissions. Installations on managed hosting still need the version check, since the flaw sits in the application code. unknown on whether hosted OpenEMR vendors have already patched.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000728,"input_tokens":4629,"output_tokens":530,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126434':14A,17A '-2026':13A,16A '8.5.0':26B,67C 'account':43B,78C 'allow':76C 'alter':7A 'attack':53B,90C 'authent':77C 'author':71C 'bn':111C 'chang':47B 'check':4A,29B 'clinic':56B,99C 'contain':68C 'cve':12A,15A 'diagnos':60B,115C 'disclos':98C 'expos':5A 'fail':27B 'falsifi':59B,114C 'form':37B 'global':94C 'healthcar':18B 'histori':57B,100C 'host':23B 'id':96C 'instruct':61B,116C 'interface/forms/procedure_order/common.php':74C 'lab':10A 'lack':79C 'log':41B 'logged-in':40B 'miss':2A,70C 'modifi':85C 'openemr':1A,19B,24B,65C 'order':11A,36B,51B,63B,89C,95C,118C 'patient':9A,49B,87C,105C 'patients/lab':31B,80C 'permiss':3A,32B,81C 'procedur':35B,50B,88C 'read':55B,83C 'request':92C 'runtim':20B 'save':112C 'select':102C 'self':22B 'self-host':21B 'session':108C 'status':64B,119C 'submit':110C 'target':104C 'view':45B 'vulner':72C","nicknames":[],"mitigations":[],"who_affected":"Clinics and hospitals that run OpenEMR on their own servers and let staff log in with accounts that lack lab permissions. Installations on managed hosting still need the version check, since the flaw sits in the application code. unknown on whether hosted OpenEMR vendors have already patched.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","runtime","selfhosted"],"campaign_type":null,"search_a":"'-126434':14A,17A '-2026':13A,16A 'alter':7A 'check':4A 'cve':12A,15A 'expos':5A 'lab':10A 'miss':2A 'openemr':1A 'order':11A 'patient':9A 'permiss':3A","search_b":"'8.5.0':26B 'account':43B 'attack':53B 'chang':47B 'check':29B 'clinic':56B 'diagnos':60B 'fail':27B 'falsifi':59B 'form':37B 'healthcar':18B 'histori':57B 'host':23B 'instruct':61B 'log':41B 'logged-in':40B 'openemr':19B,24B 'order':36B,51B,63B 'patient':49B 'patients/lab':31B 'permiss':32B 'procedur':35B,50B 'read':55B 'runtim':20B 'self':22B 'self-host':21B 'status':64B 'view':45B","search_c":"'8.5.0':67C 'account':78C 'allow':76C 'attack':90C 'authent':77C 'author':71C 'bn':111C 'clinic':99C 'contain':68C 'diagnos':115C 'disclos':98C 'falsifi':114C 'global':94C 'histori':100C 'id':96C 'instruct':116C 'interface/forms/procedure_order/common.php':74C 'lack':79C 'miss':70C 'modifi':85C 'openemr':65C 'order':89C,95C,118C 'patient':87C,105C 'patients/lab':80C 'permiss':81C 'procedur':88C 'read':83C 'request':92C 'save':112C 'select':102C 'session':108C 'status':119C 'submit':110C 'target':104C 'vulner':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T02:16:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126434","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126434","severity":null,"published_at":"2026-11-13T10:17:50+00:00","modified_at":"2026-11-13T10:17:50+00:00","first_seen_at":"2026-11-13T10:47:22+00:00","fetched_at":"2026-11-13T10:47:22+00:00","note":null}],"documents":[{"id":145112,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-q5c6-96vf-rx9v","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T02:16:12+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145113,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-procedure-order-form","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}