CVE-2026-126451 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 lets a patient using the patient portal store javascript: URLs in document template data that are later rendered unsanitized into an iframe. The script runs in a staff member's session, can read protected health information and CSRF tokens, and call staff or admin endpoints.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Clinics and organizations running OpenEMR before 8.5.0 with the patient portal enabled. The flaw needs a patient portal account, so installations without the portal are less exposed. Staff who open the affected document templates are the ones whose sessions can be abused.
Not affected if openemr-8.5.0-or-later, patient-portal-disabled
Who cares healthcare, openemr, patient-portal, self-hosted
version.php in the web root.8.5.0 are affected; move to 8.5.0 or later.OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows portal patients to run JavaScript in staff sessions by injecting javascript: URLs into document template_data. Attackers can submit an encounterForm value rendered unsanitized into an iframe src by DocumentTemplateRender, letting the script read PHI and CSRF tokens and call staff or admin endpoints.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.