CVE-2026-126445 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 lets any authenticated core user change Patient Flow Board trackers without the patients/appt permission. An attacker can alter check-in status, rooms, drug-screen completion and tracker history for patients.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
OpenEMR installations before 8.5.0 where authenticated users can reach the Patient Flow Board endpoints patient_tracker_status.php and drug_screen_completed.php. Sites on 8.5.0 or later are not affected, and attackers must hold a valid core-user login.
Not affected if no-patient-flow-board-use, openemr-8.5.0-or-later
Who cares healthcare, openemr, self-hosted
8.5.0 or later is not affected by this flaw8.5.0 or laterOpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to modify arbitrary Patient Flow Board trackers without the patients/appt permission. Attackers can submit a victim tracker_id to patient_tracker_status.php or drug_screen_completed.php to falsify check-in status, rooms, drug-screen completion, and tracker history.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.