{"id":"CVE-2026-126456","kind":"vulnerability","aliases":["CVE-2026-126456"],"related":[],"title":"OpenEMR: stored XSS in Fee Sheet notecodes runs in other users' browsers","description":"OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in the Fee Sheet notecodes field, which is escaped with the wrong context. Attackers with clinician access can inject a payload that breaks out of the single-quoted value attribute and executes in higher-privileged users' browsers.","summary":"OpenEMR before 8.5.0 escapes the Fee Sheet notecodes field in the wrong context, so stored input can break out of an HTML attribute. A clinician can plant a script that runs in the browsers of higher-privileged users.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","other","self-hosted"],"not_affected_if":["no-untrusted-clinician-accounts","openemr-8.5.0-or-later"],"how_to_check":"- Check the OpenEMR version in the installation; versions before `8.5.0` are affected according to the sources.\n- Confirm whether untrusted users hold clinician accounts that can edit Fee Sheet notecodes.","fix":"- OpenEMR: move to `8.5.0` or later, per the sources.","status":"open","published_at":"2026-11-13T10:17:53+00:00","first_seen_at":"2026-11-13T10:47:24+00:00","triaged_at":"2026-11-13T10:56:55+00:00","updated_at":"2026-11-13T10:56:55+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T10:56:55Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.5.0` or later, per the sources.","reach":"network","title":"OpenEMR: stored XSS in Fee Sheet notecodes runs in other users' browsers","impact":"medium","summary":"OpenEMR before 8.5.0 escapes the Fee Sheet notecodes field in the wrong context, so stored input can break out of an HTML attribute. A clinician can plant a script that runs in the browsers of higher-privileged users.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","healthcare","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Script runs in higher-privileged users' browsers, enabling session or data theft","analyst_note":"","how_to_check":"- Check the OpenEMR version in the installation; versions before `8.5.0` are affected according to the sources.\n- Confirm whether untrusted users hold clinician accounts that can edit Fee Sheet notecodes.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["openemr-8.5.0-or-later","no-untrusted-clinician-accounts"],"who_is_affected":"OpenEMR installations running a version before 8.5.0 where clinician accounts can edit Fee Sheet notecodes. The attacker needs clinician-level access, and the script then runs for higher-privileged users who view the affected record. Deployments that restrict clinician accounts to trusted staff have a smaller exposure.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000744,"input_tokens":4609,"output_tokens":566,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126456':15A,18A '-2026':14A,17A '8.5.0':27B,66C 'access':91C 'attack':88C 'attribut':47B,105C 'break':42B,97C 'browser':12A,58B,113C 'clinician':49B,90C 'contain':67C 'context':37B,87C 'cross':71C 'cross-sit':70C 'cve':13A,16A 'escap':28B,83C 'execut':107C 'fee':5A,30B,77C 'field':33B,80C 'healthcar':19B 'higher':61B,110C 'higher-privileg':60B,109C 'host':24B 'html':46B 'inject':93C 'input':40B 'notecod':7A,32B,79C 'openemr':1A,20B,25B,64C 'payload':95C 'plant':51B 'privileg':62B,111C 'quot':103C 'run':8A,55B 'script':53B,73C 'self':23B 'self-host':22B 'sheet':6A,31B,78C 'singl':102C 'single-quot':101C 'site':72C 'store':2A,39B,69C 'user':11A,63B,112C 'valu':104C 'vulner':74C 'wrong':36B,86C 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"OpenEMR installations running a version before 8.5.0 where clinician accounts can edit Fee Sheet notecodes. The attacker needs clinician-level access, and the script then runs for higher-privileged users who view the affected record. Deployments that restrict clinician accounts to trusted staff have a smaller exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","medium","openemr","other","selfhosted"],"campaign_type":null,"search_a":"'-126456':15A,18A '-2026':14A,17A 'browser':12A 'cve':13A,16A 'fee':5A 'notecod':7A 'openemr':1A 'run':8A 'sheet':6A 'store':2A 'user':11A 'xss':3A","search_b":"'8.5.0':27B 'attribut':47B 'break':42B 'browser':58B 'clinician':49B 'context':37B 'escap':28B 'fee':30B 'field':33B 'healthcar':19B 'higher':61B 'higher-privileg':60B 'host':24B 'html':46B 'input':40B 'notecod':32B 'openemr':20B,25B 'plant':51B 'privileg':62B 'run':55B 'script':53B 'self':23B 'self-host':22B 'sheet':31B 'store':39B 'user':63B 'wrong':36B","search_c":"'8.5.0':66C 'access':91C 'attack':88C 'attribut':105C 'break':97C 'browser':113C 'clinician':90C 'contain':67C 'context':87C 'cross':71C 'cross-sit':70C 'escap':83C 'execut':107C 'fee':77C 'field':80C 'higher':110C 'higher-privileg':109C 'inject':93C 'notecod':79C 'openemr':64C 'payload':95C 'privileg':111C 'quot':103C 'script':73C 'sheet':78C 'singl':102C 'single-quot':101C 'site':72C 'store':69C 'user':112C 'valu':104C 'vulner':74C 'wrong':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:39:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126456","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126456","severity":null,"published_at":"2026-11-13T10:17:53+00:00","modified_at":"2026-11-13T10:17:53+00:00","first_seen_at":"2026-11-13T10:47:24+00:00","fetched_at":"2026-11-13T10:47:24+00:00","note":null}],"documents":[{"id":145157,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-ff55-qvf9-2fgm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:39:43+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145158,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-fee-sheet-notecodes-field","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}