{"id":"CVE-2026-126441","kind":"vulnerability","aliases":["CVE-2026-126441"],"related":[],"title":"OpenEMR: authenticated users can read other patients' prescriptions via print page","description":"OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the CAMOS rx_print.php printer that allows authenticated users to read other patients' prescriptions. Attackers can submit forged chrx_ parameters with global prescription IDs to disclose drug names, dosages, directions, and refill counts without medication permissions.","summary":"OpenEMR before 8.5.0 has an insecure direct object reference in the CAMOS rx_print.php printer, so a logged-in user can submit forged chrx_ prescription IDs. An attacker can read other patients' drug names, dosages, directions and refill counts without medication permissions.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","php","runtime","self-hosted"],"not_affected_if":["camos-not-used","version-8.5.0-or-later"],"how_to_check":"- Check the OpenEMR version in the installed application; versions below `8.5.0` are affected.\n- Confirm whether the CAMOS module is in use and whether `rx_print.php` is reachable.","fix":"- OpenEMR: move to `8.5.0` or later.","status":"open","published_at":"2026-11-13T10:17:51+00:00","first_seen_at":"2026-11-13T10:47:22+00:00","triaged_at":"2026-11-13T10:56:35+00:00","updated_at":"2026-11-13T10:56:35+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-13T10:56:35Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.5.0` or later.","reach":"network","title":"OpenEMR: authenticated users can read other patients' prescriptions via print page","impact":"medium","summary":"OpenEMR before 8.5.0 has an insecure direct object reference in the CAMOS rx_print.php printer, so a logged-in user can submit forged chrx_ prescription IDs. An attacker can read other patients' drug names, dosages, directions and refill counts without medication permissions.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user reads other patients' prescription details","analyst_note":"Fixed version 8.5.0 is stated; whether CAMOS is enabled by default is not confirmed by the sources.","how_to_check":"- Check the OpenEMR version in the installed application; versions below `8.5.0` are affected.\n- Confirm whether the CAMOS module is in use and whether `rx_print.php` is reachable.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-8.5.0-or-later","camos-not-used"],"who_is_affected":"Any OpenEMR deployment before 8.5.0 where users have logins and the CAMOS prescription printing feature is in use. Deployments on 8.5.0 or later, or without CAMOS, are not affected per the sources.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00074,"input_tokens":4618,"output_tokens":556,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126441':14A,17A '-2026':13A,16A '8.5.0':27B,69C 'allow':83C 'attack':52B,91C 'authent':2A,84C 'camo':36B,79C 'chrx':48B,95C 'contain':70C 'count':63B,109C 'cve':12A,15A 'direct':31B,60B,73C,106C 'disclos':102C 'dosag':59B,105C 'drug':57B,103C 'forg':47B,94C 'global':98C 'healthcar':18B 'host':24B 'id':50B,100C 'insecur':30B,72C 'log':42B 'logged-in':41B 'medic':65B,111C 'name':58B,104C 'object':32B,74C 'openemr':1A,19B,25B,67C 'page':11A 'paramet':96C 'patient':7A,56B,89C 'permiss':66B,112C 'php':20B 'prescript':8A,49B,90C,99C 'print':10A 'printer':38B,81C 'read':5A,54B,87C 'refer':33B,75C 'refil':62B,108C 'runtim':21B 'rx_print.php':37B,80C 'self':23B 'self-host':22B 'submit':46B,93C 'user':3A,44B,85C 'via':9A 'vulner':76C 'without':64B,110C","nicknames":[],"mitigations":[],"who_affected":"Any OpenEMR deployment before 8.5.0 where users have logins and the CAMOS prescription printing feature is in use. Deployments on 8.5.0 or later, or without CAMOS, are not affected per the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","medium","openemr","php","runtime","selfhosted"],"campaign_type":null,"search_a":"'-126441':14A,17A '-2026':13A,16A 'authent':2A 'cve':12A,15A 'openemr':1A 'page':11A 'patient':7A 'prescript':8A 'print':10A 'read':5A 'user':3A 'via':9A","search_b":"'8.5.0':27B 'attack':52B 'camo':36B 'chrx':48B 'count':63B 'direct':31B,60B 'dosag':59B 'drug':57B 'forg':47B 'healthcar':18B 'host':24B 'id':50B 'insecur':30B 'log':42B 'logged-in':41B 'medic':65B 'name':58B 'object':32B 'openemr':19B,25B 'patient':56B 'permiss':66B 'php':20B 'prescript':49B 'printer':38B 'read':54B 'refer':33B 'refil':62B 'runtim':21B 'rx_print.php':37B 'self':23B 'self-host':22B 'submit':46B 'user':44B 'without':64B","search_c":"'8.5.0':69C 'allow':83C 'attack':91C 'authent':84C 'camo':79C 'chrx':95C 'contain':70C 'count':109C 'direct':73C,106C 'disclos':102C 'dosag':105C 'drug':103C 'forg':94C 'global':98C 'id':100C 'insecur':72C 'medic':111C 'name':104C 'object':74C 'openemr':67C 'paramet':96C 'patient':89C 'permiss':112C 'prescript':90C,99C 'printer':81C 'read':87C 'refer':75C 'refil':108C 'rx_print.php':80C 'submit':93C 'user':85C 'vulner':76C 'without':110C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:37:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126441","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126441","severity":null,"published_at":"2026-11-13T10:17:51+00:00","modified_at":"2026-11-13T10:17:51+00:00","first_seen_at":"2026-11-13T10:47:22+00:00","fetched_at":"2026-11-13T10:47:22+00:00","note":null}],"documents":[{"id":145126,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-gf9c-4hh8-gh49","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:37:24+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145127,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-idor-via-camos-rx-print-php-prescription-disclosure","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}