{"id":"CVE-2026-126452","kind":"vulnerability","aliases":["CVE-2026-126452"],"related":[],"title":"OpenEMR: missing authorization lets logged-in users delete any billing record","description":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in diagnosis_full.php that allows authenticated users to delete or clear any billing record by ID. Attackers can supply a target billing ID in the id parameter with delete or clear mode to deactivate other patients' charges and corrupt financial records.","summary":"OpenEMR before 8.5.0 has a missing authorization check in diagnosis_full.php. An authenticated user can delete or clear any billing record by supplying its ID, deactivating other patients' charges and corrupting financial records.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OpenEMR","fixed":["8.5.0"],"affected":"< 8.5.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["authenticated","healthcare","openemr","other","self-hosted"],"not_affected_if":["version-8.5.0-or-later"],"how_to_check":"Compare your installed OpenEMR version with 8.5.0; anything below is affected (every user role can reach the endpoint). Look for requests to /interface/patient_file/encounter/diagnosis_full.php with id= and mode=delete or clear in web server logs.","fix":"Upgrade OpenEMR to 8.5.0 or later.","status":"open","published_at":"2026-11-13T10:17:53+00:00","first_seen_at":"2026-11-13T10:47:23+00:00","triaged_at":"2026-11-13T10:53:07+00:00","updated_at":"2026-11-13T10:54:12+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-13T10:53:07Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: upgrade to `8.5.0` or later","reach":"network","title":"OpenEMR: missing authorization lets logged-in users delete any billing record","impact":"medium","summary":"OpenEMR before 8.5.0 has a missing authorization check in diagnosis_full.php. An authenticated user can delete or clear any billing record by supplying its ID, deactivating other patients' charges and corrupting financial records.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","healthcare","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"billing records of other patients deleted or corrupted by any logged-in user","analyst_note":"Confirm which user roles can reach diagnosis_full.php and check the vendor advisory on github.com for detection steps.","how_to_check":"unknown","plain_action":"","product_name":"OpenEMR","needs_analyst":true,"not_affected_if":["version-8.5.0-or-later"],"who_is_affected":"Any clinic or organization running OpenEMR before 8.5.0 where users have accounts. The flaw is in the billing diagnosis handler, so exposure depends on whether that code path is reachable by the user's role. Installations already on 8.5.0 or later are not affected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000715,"input_tokens":4605,"output_tokens":509,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm which user roles can reach diagnosis_full.php and check the vendor advisory on github.com for detection steps.","search":"'-126452':15A,18A '-2026':14A,17A '8.5.0':29B,61C 'allow':70C 'attack':82C 'authent':20B,38B,71C 'author':3A,33B,65C 'bill':11A,45B,78C,87C 'charg':54B,102C 'check':34B 'clear':43B,76C,96C 'contain':62C 'corrupt':56B,104C 'cve':13A,16A 'deactiv':51B,99C 'delet':9A,41B,74C,94C 'diagnosis_full.php':36B,68C 'financi':57B,105C 'healthcar':21B 'host':26B 'id':50B,81C,88C,91C 'let':4A 'log':6A 'logged-in':5A 'miss':2A,32B,64C 'mode':97C 'openemr':1A,19A,22B,27B,59C 'paramet':92C 'patient':53B,101C 'record':12A,46B,58B,79C,106C 'self':25B 'self-host':24B 'suppli':48B,84C 'target':86C 'user':8A,39B,72C 'vulner':66C","nicknames":[],"mitigations":[],"who_affected":"Any clinic or organisation running self-hosted OpenEMR before 8.5.0. Any logged-in user, whatever their role, can deactivate or clear any patient's billing record through diagnosis_full.php by supplying its numeric ID. Installations on 8.5.0 or later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-13T10:54:12Z","by":"analyst","doc":"https://github.com/openemr/openemr/security/advisories/GHSA-r65f-fxf6-4fwr","run_id":3868},"products":{"at":"2026-11-13T10:54:12Z","by":"analyst","doc":"https://github.com/openemr/openemr/security/advisories/GHSA-r65f-fxf6-4fwr","run_id":3868},"who_affected":{"at":"2026-11-13T10:54:12Z","by":"analyst","doc":"https://github.com/openemr/openemr/security/advisories/GHSA-r65f-fxf6-4fwr","run_id":3868}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["openemr"],"ptokens":["openemr"],"labels":["authenticated","healthcare","high","openemr","other","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126452':15A,18A '-2026':14A,17A 'author':3A 'bill':11A 'cve':13A,16A 'delet':9A 'let':4A 'log':6A 'logged-in':5A 'miss':2A 'openemr':1A,19A 'record':12A 'user':8A","search_b":"'8.5.0':29B 'authent':20B,38B 'author':33B 'bill':45B 'charg':54B 'check':34B 'clear':43B 'corrupt':56B 'deactiv':51B 'delet':41B 'diagnosis_full.php':36B 'financi':57B 'healthcar':21B 'host':26B 'id':50B 'miss':32B 'openemr':22B,27B 'patient':53B 'record':46B,58B 'self':25B 'self-host':24B 'suppli':48B 'user':39B","search_c":"'8.5.0':61C 'allow':70C 'attack':82C 'authent':71C 'author':65C 'bill':78C,87C 'charg':102C 'clear':76C,96C 'contain':62C 'corrupt':104C 'deactiv':99C 'delet':74C,94C 'diagnosis_full.php':68C 'financi':105C 'id':81C,88C,91C 'miss':64C 'mode':97C 'openemr':59C 'paramet':92C 'patient':101C 'record':79C,106C 'suppli':84C 'target':86C 'user':72C 'vulner':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:19:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126452","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126452","severity":null,"published_at":"2026-11-13T10:17:53+00:00","modified_at":"2026-11-13T10:17:53+00:00","first_seen_at":"2026-11-13T10:47:23+00:00","fetched_at":"2026-11-13T10:47:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126452:3868","url":null,"severity":null,"published_at":"2026-11-13T10:54:12+00:00","modified_at":"2026-11-13T10:54:12+00:00","first_seen_at":"2026-11-13T10:54:12+00:00","fetched_at":"2026-11-13T10:54:12+00:00","note":"Read GHSA-r65f-fxf6-4fwr: affected <8.5.0, fixed 8.5.0. No ACL check in diagnosis_full.php; any authenticated user (no specific role) can delete/clear any billing row by id. Advisory title says unauthenticated but its impact text and CVSS PR:L say login required. No exploitation or PoC beyond the advisory's own steps; no mitigations or discussion searched."}],"documents":[{"id":145148,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-r65f-fxf6-4fwr","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:19:35+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145149,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-diagnosis-full-php-billing-operations","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}