OPENEMR · CVE-2026-126446 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 does not check permissions on its destroyed-drugs report page, so any authenticated user can open it. An attacker with a normal account can read drug names, NDC codes, lots, quantities, destruction methods, witnesses and notes for a chosen date range.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Clinics and hospitals that run OpenEMR with user accounts that are not limited to drug inventory roles. Exposure requires a valid login; installs where only admins can sign in are less exposed, but the sources do not say which accounts are restricted by default. Hosted or vendor-managed OpenEMR instances should be checked with the provider.
Not affected if no-authenticated-users-beyond-admins, version-8.5.0-or-later
Who cares healthcare, openemr, self-hosted
8.5.0 are affected.destroyed_drugs_report.php in the OpenEMR web root and confirm whether it enforces the admin/drugs or inventory/reporting ACL.8.5.0 or later.OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to retrieve destroyed-drug records because destroyed_drugs_report.php lacks the admin/drugs or inventory/reporting ACL check. Attackers can submit the report refresh form with a chosen date range to obtain drug names, NDC, lots, quantities, destruction methods, witnesses, and notes.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.