CVE-2026-126435 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 lets a user with only medication-view permission request any order ID through interface/orders/order_manifest.php and read patient data outside their squad restrictions. The same page accepts a state change without a CSRF token that sets do_not_send flags, suppressing ordered lab procedures.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any OpenEMR deployment before 8.5.0 where users hold medication-view permission, since that is the only permission the flaw needs. Clinics and hospitals running OpenEMR as a patient records system are the exposed setting; installs on 8.5.0 or later are not affected.
Not affected if version-8.5.0-or-later
Who cares healthcare, openemr, self-hosted
8.5.0 are affected.interface/orders/order_manifest.php is present and reachable on the deployment.8.5.0 or later (the sources state the fix is in versions from 8.5.0).OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/order_manifest.php, which checks patients/med without requiring write access or applying patient squad restrictions. Users with only patients/med view permission can request any order ID to read squad-restricted patient data and submit bn_save and form_omit parameters, without a CSRF token, to set do_not_send flags that suppress ordered lab procedures.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.