{"id":"CVE-2026-126455","kind":"vulnerability","aliases":["CVE-2026-126455"],"related":[],"title":"OpenEMR: missing authorization and SQL injection let clerks read the database","description":"OpenEMR before 8.5.0 contains multiple missing authorization and SQL injection defects across report, portal, transaction, and immunization components. Low-privileged Front Office clerks can chain these to read arbitrary database tables including users_secure hashes, hijack patient portal identities, and forge approved clinical records.","summary":"OpenEMR before 8.5.0 has several missing authorization checks and SQL injection flaws in its report, patient portal, transaction and immunization components. A low-privileged Front Office clerk can chain them to read arbitrary database tables, including password hashes, take over patient portal accounts and forge approved clinical records.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","other","self-hosted"],"not_affected_if":["version-8.5.0-or-later"],"how_to_check":"- Check the OpenEMR version in the installation; the sources say versions before `8.5.0` are affected.\n- Confirm whether the patient portal and report features are in use on the instance.","fix":"- Upgrade OpenEMR to `8.5.0` or later.","status":"open","published_at":"2026-11-13T10:17:53+00:00","first_seen_at":"2026-11-13T10:47:24+00:00","triaged_at":"2026-11-13T10:50:44+00:00","updated_at":"2026-11-13T10:50:44+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T10:50:44Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenEMR to `8.5.0` or later.","reach":"unknown","title":"OpenEMR: missing authorization and SQL injection let clerks read the database","impact":"high","summary":"OpenEMR before 8.5.0 has several missing authorization checks and SQL injection flaws in its report, patient portal, transaction and immunization components. A low-privileged Front Office clerk can chain them to read arbitrary database tables, including password hashes, take over patient portal accounts and forge approved clinical records.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","healthcare","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads password hashes and forges clinical records","analyst_note":"Check the vendor advisory and the Patch link to confirm the exact affected components, whether any unauthenticated path exists, and any workaround before 8.5.0.","how_to_check":"- Check the OpenEMR version in the installation; the sources say versions before `8.5.0` are affected.\n- Confirm whether the patient portal and report features are in use on the instance.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-8.5.0-or-later"],"who_is_affected":"OpenEMR installations running a version before 8.5.0. The sources describe exposure through Front Office clerk accounts, so any instance where staff accounts with low privileges exist is in scope. The sources do not say whether the flaw is reachable from the internet without a login.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000748,"input_tokens":4610,"output_tokens":574,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126455':14A,17A '-2026':13A,16A '8.5.0':26B,75C 'account':67B 'across':84C 'approv':70B,115C 'arbitrari':57B,102C 'author':3A,30B,79C 'chain':53B,98C 'check':31B 'clerk':8A,51B,96C 'clinic':71B,116C 'compon':44B,90C 'contain':76C 'cve':12A,15A 'databas':11A,58B,103C 'defect':83C 'flaw':35B 'forg':69B,114C 'front':49B,94C 'hash':62B,108C 'healthcar':18B 'hijack':109C 'host':23B 'ident':112C 'immun':43B,89C 'includ':60B,105C 'inject':6A,34B,82C 'let':7A 'low':47B,92C 'low-privileg':46B,91C 'miss':2A,29B,78C 'multipl':77C 'offic':50B,95C 'openemr':1A,19B,24B,73C 'password':61B 'patient':39B,65B,110C 'portal':40B,66B,86C,111C 'privileg':48B,93C 'read':9A,56B,101C 'record':72B,117C 'report':38B,85C 'secur':107C 'self':22B 'self-host':21B 'sever':28B 'sql':5A,33B,81C 'tabl':59B,104C 'take':63B 'transact':41B,87C 'user':106C","nicknames":[],"mitigations":[],"who_affected":"OpenEMR installations running a version before 8.5.0. The sources describe exposure through Front Office clerk accounts, so any instance where staff accounts with low privileges exist is in scope. The sources do not say whether the flaw is reachable from the internet without a login.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","other","selfhosted"],"campaign_type":null,"search_a":"'-126455':14A,17A '-2026':13A,16A 'author':3A 'clerk':8A 'cve':12A,15A 'databas':11A 'inject':6A 'let':7A 'miss':2A 'openemr':1A 'read':9A 'sql':5A","search_b":"'8.5.0':26B 'account':67B 'approv':70B 'arbitrari':57B 'author':30B 'chain':53B 'check':31B 'clerk':51B 'clinic':71B 'compon':44B 'databas':58B 'flaw':35B 'forg':69B 'front':49B 'hash':62B 'healthcar':18B 'host':23B 'immun':43B 'includ':60B 'inject':34B 'low':47B 'low-privileg':46B 'miss':29B 'offic':50B 'openemr':19B,24B 'password':61B 'patient':39B,65B 'portal':40B,66B 'privileg':48B 'read':56B 'record':72B 'report':38B 'self':22B 'self-host':21B 'sever':28B 'sql':33B 'tabl':59B 'take':63B 'transact':41B","search_c":"'8.5.0':75C 'across':84C 'approv':115C 'arbitrari':102C 'author':79C 'chain':98C 'clerk':96C 'clinic':116C 'compon':90C 'contain':76C 'databas':103C 'defect':83C 'forg':114C 'front':94C 'hash':108C 'hijack':109C 'ident':112C 'immun':89C 'includ':105C 'inject':82C 'low':92C 'low-privileg':91C 'miss':78C 'multipl':77C 'offic':95C 'openemr':73C 'patient':110C 'portal':86C,111C 'privileg':93C 'read':101C 'record':117C 'report':85C 'secur':107C 'sql':81C 'tabl':104C 'transact':87C 'user':106C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:42:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126455","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126455","severity":null,"published_at":"2026-11-13T10:17:53+00:00","modified_at":"2026-11-13T10:17:53+00:00","first_seen_at":"2026-11-13T10:47:24+00:00","fetched_at":"2026-11-13T10:47:24+00:00","note":null}],"documents":[{"id":145154,"url":"https://github.com/openemr/openemr/commit/71da6605dc3bcc1405ee9a65cb9f579ecbc8a1c6","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145155,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-vr7f-7c3w-49g7","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:42:47+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145156,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-privilege-escalation-via-missing-authorization-and-sql-injection","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}