CVE-2026-126455 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 has several missing authorization checks and SQL injection flaws in its report, patient portal, transaction and immunization components. A low-privileged Front Office clerk can chain them to read arbitrary database tables, including password hashes, take over patient portal accounts and forge approved clinical records.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
OpenEMR installations running a version before 8.5.0. The sources describe exposure through Front Office clerk accounts, so any instance where staff accounts with low privileges exist is in scope. The sources do not say whether the flaw is reachable from the internet without a login.
Not affected if version-8.5.0-or-later
Who cares healthcare, openemr, self-hosted
8.5.0 are affected.8.5.0 or later.OpenEMR before 8.5.0 contains multiple missing authorization and SQL injection defects across report, portal, transaction, and immunization components. Low-privileged Front Office clerks can chain these to read arbitrary database tables including users_secure hashes, hijack patient portal identities, and forge approved clinical records.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.