OPENEMR · CVE-2026-126452 · Other
FIX → 8.5.0 ✓ verified
OpenEMR before 8.5.0 has a missing authorization check in diagnosis_full.php. An authenticated user can delete or clear any billing record by supplying its ID, deactivating other patients' charges and corrupting financial records.
first public Oct 28, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any clinic or organisation running self-hosted OpenEMR before 8.5.0. Any logged-in user, whatever their role, can deactivate or clear any patient's billing record through diagnosis_full.php by supplying its numeric ID. Installations on 8.5.0 or later can skip it.
Not affected if version-8.5.0-or-later
Who cares authenticated, healthcare, openemr, self-hosted
8.5.0; anything below is affected (every user role can reach the endpoint)Upgrade to 8.5.0
Upgrade OpenEMR to 8.5.0 or later.
OpenEMR before 8.5.0 contains a missing authorization vulnerability in diagnosis_full.php that allows authenticated users to delete or clear any billing record by ID. Attackers can supply a target billing ID in the id parameter with delete or clear mode to deactivate other patients' charges and corrupt financial records.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.