OPENEMR · CVE-2026-126458 · Package
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 lets any logged-in staff member mark arbitrary patients' billing, forms, notes and transactions as authorized, skipping provider review. An attacker with a staff account gets to alter clinical record authorization for patients they should not touch.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
OpenEMR installations before 8.5.0 where staff accounts exist. Any authenticated staff user can exploit the missing authorization check on authorizations_full.php, so deployments with only a single trusted user or no staff accounts are less exposed. Sources do not say whether non-default configuration is required.
Not affected if openemr-8.5.0-or-later
Who cares healthcare, openemr, php, self-hosted
8.5.0.authorizations_full.php is present and reachable on the deployment.8.5.0 or later (per the advisory cited in the sources).OpenEMR before 8.5.0 contains a missing authorization vulnerability in authorizations_full.php that allows any authenticated staff user to authorize arbitrary patients' clinical records. Attackers can send a mode=authorize request with an attacker-chosen pid and their own CSRF token to set authorized=1 on billing, forms, pnotes, and transactions records, bypassing provider review.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.