{"id":"CVE-2026-126435","kind":"vulnerability","aliases":["CVE-2026-126435"],"related":[],"title":"OpenEMR: low-privilege users can read restricted patient data and suppress lab orders","description":"OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/order_manifest.php, which checks patients/med without requiring write access or applying patient squad restrictions. Users with only patients/med view permission can request any order ID to read squad-restricted patient data and submit bn_save and form_omit parameters, without a CSRF token, to set do_not_send flags that suppress ordered lab procedures.","summary":"OpenEMR before 8.5.0 lets a user with only medication-view permission request any order ID through interface/orders/order_manifest.php and read patient data outside their squad restrictions. The same page accepts a state change without a CSRF token that sets do_not_send flags, suppressing ordered lab procedures.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","runtime","self-hosted"],"not_affected_if":["version-8.5.0-or-later"],"how_to_check":"- Check the OpenEMR version in use; the sources state versions before `8.5.0` are affected.\n- Look at whether `interface/orders/order_manifest.php` is present and reachable on the deployment.","fix":"- OpenEMR: move to `8.5.0` or later (the sources state the fix is in versions from `8.5.0`).","status":"open","published_at":"2026-11-13T10:17:50+00:00","first_seen_at":"2026-11-13T10:47:22+00:00","triaged_at":"2026-11-13T10:56:56+00:00","updated_at":"2026-11-13T10:56:56+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-13T10:56:56Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.5.0` or later (the sources state the fix is in versions from `8.5.0`).","reach":"network","title":"OpenEMR: low-privilege users can read restricted patient data and suppress lab orders","impact":"medium","summary":"OpenEMR before 8.5.0 lets a user with only medication-view permission request any order ID through interface/orders/order_manifest.php and read patient data outside their squad restrictions. The same page accepts a state change without a CSRF token that sets do_not_send flags, suppressing ordered lab procedures.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","healthcare","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"low-privilege user reads restricted patient data and suppresses lab orders","analyst_note":"Confirm the fixed version and any workaround at the vendor advisory linked from the NVD entry, since the sources give no product ranges.","how_to_check":"- Check the OpenEMR version in use; the sources state versions before `8.5.0` are affected.\n- Look at whether `interface/orders/order_manifest.php` is present and reachable on the deployment.\n- unknown for other checks; the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-8.5.0-or-later"],"who_is_affected":"Any OpenEMR deployment before 8.5.0 where users hold medication-view permission, since that is the only permission the flaw needs. Clinics and hospitals running OpenEMR as a patient records system are the exposed setting; installs on 8.5.0 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000774,"input_tokens":4640,"output_tokens":619,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126435':17A,20A '-2026':16A,19A '8.5.0':29B,76C 'accept':56B 'access':90C 'appli':92C 'author':80C 'bn':116C 'chang':59B 'check':85C 'contain':77C 'csrf':62B,124C 'cve':15A,18A 'data':10A,48B,113C 'flag':69B,131C 'form':119C 'healthcar':21B 'host':26B 'id':42B,106C 'improp':79C 'interface/orders/order_manifest.php':44B,83C 'lab':13A,72B,135C 'let':30B 'low':3A 'low-privileg':2A 'medic':36B 'medication-view':35B 'omit':120C 'openemr':1A,22B,27B,74C 'order':14A,41B,71B,105C,134C 'outsid':49B 'page':55B 'paramet':121C 'patient':9A,47B,93C,112C 'patients/med':86C,99C 'permiss':38B,101C 'privileg':4A 'procedur':73B,136C 'read':7A,46B,108C 'request':39B,103C 'requir':88C 'restrict':8A,52B,95C,111C 'runtim':23B 'save':117C 'self':25B 'self-host':24B 'send':68B,130C 'set':65B,127C 'squad':51B,94C,110C 'squad-restrict':109C 'state':58B 'submit':115C 'suppress':12A,70B,133C 'token':63B,125C 'user':5A,32B,96C 'view':37B,100C 'vulner':81C 'without':60B,87C,122C 'write':89C","nicknames":[],"mitigations":[],"who_affected":"Any OpenEMR deployment before 8.5.0 where users hold medication-view permission, since that is the only permission the flaw needs. Clinics and hospitals running OpenEMR as a patient records system are the exposed setting; installs on 8.5.0 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","medium","openemr","runtime","selfhosted"],"campaign_type":null,"search_a":"'-126435':17A,20A '-2026':16A,19A 'cve':15A,18A 'data':10A 'lab':13A 'low':3A 'low-privileg':2A 'openemr':1A 'order':14A 'patient':9A 'privileg':4A 'read':7A 'restrict':8A 'suppress':12A 'user':5A","search_b":"'8.5.0':29B 'accept':56B 'chang':59B 'csrf':62B 'data':48B 'flag':69B 'healthcar':21B 'host':26B 'id':42B 'interface/orders/order_manifest.php':44B 'lab':72B 'let':30B 'medic':36B 'medication-view':35B 'openemr':22B,27B 'order':41B,71B 'outsid':49B 'page':55B 'patient':47B 'permiss':38B 'procedur':73B 'read':46B 'request':39B 'restrict':52B 'runtim':23B 'self':25B 'self-host':24B 'send':68B 'set':65B 'squad':51B 'state':58B 'suppress':70B 'token':63B 'user':32B 'view':37B 'without':60B","search_c":"'8.5.0':76C 'access':90C 'appli':92C 'author':80C 'bn':116C 'check':85C 'contain':77C 'csrf':124C 'data':113C 'flag':131C 'form':119C 'id':106C 'improp':79C 'interface/orders/order_manifest.php':83C 'lab':135C 'omit':120C 'openemr':74C 'order':105C,134C 'paramet':121C 'patient':93C,112C 'patients/med':86C,99C 'permiss':101C 'procedur':136C 'read':108C 'request':103C 'requir':88C 'restrict':95C,111C 'save':117C 'send':130C 'set':127C 'squad':94C,110C 'squad-restrict':109C 'submit':115C 'suppress':133C 'token':125C 'user':96C 'view':100C 'vulner':81C 'without':87C,122C 'write':89C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:48:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126435","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126435","severity":null,"published_at":"2026-11-13T10:17:50+00:00","modified_at":"2026-11-13T10:17:50+00:00","first_seen_at":"2026-11-13T10:47:22+00:00","fetched_at":"2026-11-13T10:47:22+00:00","note":null}],"documents":[{"id":145114,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-xmjf-8fc9-hh38","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:48:30+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145115,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-improper-authorization-via-order-manifest-php-lab-order-flags","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}