{"id":"CVE-2026-126444","kind":"vulnerability","aliases":["CVE-2026-126444"],"related":[],"title":"OpenEMR: staff without prescription permission can read patient prescription data","description":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Ensora eRx integration that allows authenticated staff without patients/rx permission to access prescription data by directly requesting eRx.php. Attackers can expose selected patients' demographic, medication, and allergy data in the vendor XML and trigger eRx synchronization state changes.","summary":"OpenEMR before 8.5.0 has a missing authorization check in its Ensora eRx integration. An authenticated staff user without the patients/rx permission can request eRx.php directly and read selected patients' demographic, medication and allergy data.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ehr","healthcare","openemr","php","runtime","self-hosted"],"not_affected_if":["erx-integration-disabled","version-8.5.0-or-later"],"how_to_check":"- Check the OpenEMR version in the installed application (for example the version shown in the admin footer or `version.php`).\n- Confirm whether the Ensora eRx integration is enabled in the installation.","fix":"- Move OpenEMR to `8.5.0` or later.","status":"open","published_at":"2026-11-13T10:17:51+00:00","first_seen_at":"2026-11-13T10:47:23+00:00","triaged_at":"2026-11-13T10:56:35+00:00","updated_at":"2026-11-13T10:56:35+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-13T10:56:35Z","model":"claude-haiku-5-5","output":{"fix":"- Move OpenEMR to `8.5.0` or later.","reach":"network","title":"OpenEMR: staff without prescription permission can read patient prescription data","impact":"medium","summary":"OpenEMR before 8.5.0 has a missing authorization check in its Ensora eRx integration. An authenticated staff user without the patients/rx permission can request eRx.php directly and read selected patients' demographic, medication and allergy data.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","healthcare","ehr","php","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated low-privilege staff read patient medication and allergy data","analyst_note":"Product ranges were not listed in the input, so the affected product name and ecosystem are inferred from the description and the fix version is taken from the description text only.\n","how_to_check":"- Check the OpenEMR version in the installed application (for example the version shown in the admin footer or `version.php`).\n- Confirm whether the Ensora eRx integration is enabled in the installation.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-8.5.0-or-later","erx-integration-disabled"],"who_is_affected":"Clinics and practices running OpenEMR before 8.5.0 with the Ensora eRx integration in use are exposed. The attacker must already be a logged-in staff user, but one lacking the patients/rx permission can still reach prescription data by requesting the eRx endpoint directly. Installations on 8.5.0 or later, or without the eRx integration, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000762,"input_tokens":4616,"output_tokens":601,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126444':13A,16A '-2026':12A,15A '8.5.0':27B,61C 'access':80C 'allergi':57B,95C 'allow':73C 'attack':87C 'authent':39B,74C 'author':31B,65C 'chang':106C 'check':32B 'contain':62C 'cve':11A,14A 'data':10A,58B,82C,96C 'demograph':54B,92C 'direct':49B,84C 'ehr':17B 'ensora':35B,69C 'erx':36B,70C,103C 'erx.php':48B,86C 'expos':89C 'healthcar':18B 'host':24B 'integr':37B,71C 'medic':55B,93C 'miss':30B,64C 'openemr':1A,19B,25B,59C 'patient':8A,53B,91C 'patients/rx':44B,77C 'permiss':5A,45B,78C 'php':20B 'prescript':4A,9A,81C 'read':7A,51B 'request':47B,85C 'runtim':21B 'select':52B,90C 'self':23B 'self-host':22B 'staff':2A,40B,75C 'state':105C 'synchron':104C 'trigger':102C 'user':41B 'vendor':99C 'vulner':66C 'without':3A,42B,76C 'xml':100C","nicknames":[],"mitigations":[],"who_affected":"Clinics and practices running OpenEMR before 8.5.0 with the Ensora eRx integration in use are exposed. The attacker must already be a logged-in staff user, but one lacking the patients/rx permission can still reach prescription data by requesting the eRx endpoint directly. Installations on 8.5.0 or later, or without the eRx integration, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ehr","healthcare","medium","openemr","php","runtime","selfhosted"],"campaign_type":null,"search_a":"'-126444':13A,16A '-2026':12A,15A 'cve':11A,14A 'data':10A 'openemr':1A 'patient':8A 'permiss':5A 'prescript':4A,9A 'read':7A 'staff':2A 'without':3A","search_b":"'8.5.0':27B 'allergi':57B 'authent':39B 'author':31B 'check':32B 'data':58B 'demograph':54B 'direct':49B 'ehr':17B 'ensora':35B 'erx':36B 'erx.php':48B 'healthcar':18B 'host':24B 'integr':37B 'medic':55B 'miss':30B 'openemr':19B,25B 'patient':53B 'patients/rx':44B 'permiss':45B 'php':20B 'read':51B 'request':47B 'runtim':21B 'select':52B 'self':23B 'self-host':22B 'staff':40B 'user':41B 'without':42B","search_c":"'8.5.0':61C 'access':80C 'allergi':95C 'allow':73C 'attack':87C 'authent':74C 'author':65C 'chang':106C 'contain':62C 'data':82C,96C 'demograph':92C 'direct':84C 'ensora':69C 'erx':70C,103C 'erx.php':86C 'expos':89C 'integr':71C 'medic':93C 'miss':64C 'openemr':59C 'patient':91C 'patients/rx':77C 'permiss':78C 'prescript':81C 'request':85C 'select':90C 'staff':75C 'state':105C 'synchron':104C 'trigger':102C 'vendor':99C 'vulner':66C 'without':76C 'xml':100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:40:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126444","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126444","severity":null,"published_at":"2026-11-13T10:17:51+00:00","modified_at":"2026-11-13T10:17:51+00:00","first_seen_at":"2026-11-13T10:47:23+00:00","fetched_at":"2026-11-13T10:47:23+00:00","note":null}],"documents":[{"id":145132,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-mcr3-5rq6-9vvj","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:40:08+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145133,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-ensora-erx-via-erx-php","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}