{"id":"CVE-2026-126458","kind":"vulnerability","aliases":["CVE-2026-126458"],"related":[],"title":"OpenEMR: any staff user can authorize other patients' clinical records","description":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in authorizations_full.php that allows any authenticated staff user to authorize arbitrary patients' clinical records. Attackers can send a mode=authorize request with an attacker-chosen pid and their own CSRF token to set authorized=1 on billing, forms, pnotes, and transactions records, bypassing provider review.","summary":"OpenEMR before 8.5.0 lets any logged-in staff member mark arbitrary patients' billing, forms, notes and transactions as authorized, skipping provider review. An attacker with a staff account gets to alter clinical record authorization for patients they should not touch.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OpenEMR","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["healthcare","openemr","package","php","self-hosted"],"not_affected_if":["openemr-8.5.0-or-later"],"how_to_check":"- Check the installed OpenEMR version in the application's version or footer information and confirm whether it is below `8.5.0`.\n- Review whether `authorizations_full.php` is present and reachable on the deployment.","fix":"- OpenEMR: upgrade to `8.5.0` or later (per the advisory cited in the sources).","status":"open","published_at":"2026-11-13T10:17:54+00:00","first_seen_at":"2026-11-13T10:47:24+00:00","triaged_at":"2026-11-13T10:48:55+00:00","updated_at":"2026-11-13T10:48:55+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:48:55Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: upgrade to `8.5.0` or later (per the advisory cited in the sources).","reach":"network","title":"OpenEMR: any staff user can authorize other patients' clinical records","impact":"medium","summary":"OpenEMR before 8.5.0 lets any logged-in staff member mark arbitrary patients' billing, forms, notes and transactions as authorized, skipping provider review. An attacker with a staff account gets to alter clinical record authorization for patients they should not touch.","audience":"businesses","category":"package","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"staff user alters clinical record authorizations for any patient","analyst_note":"","how_to_check":"- Check the installed OpenEMR version in the application's version or footer information and confirm whether it is below `8.5.0`.\n- Review whether `authorizations_full.php` is present and reachable on the deployment.","plain_action":"","product_name":"OpenEMR","needs_analyst":false,"not_affected_if":["openemr-8.5.0-or-later"],"who_is_affected":"OpenEMR installations before 8.5.0 where staff accounts exist. Any authenticated staff user can exploit the missing authorization check on authorizations_full.php, so deployments with only a single trusted user or no staff accounts are less exposed. Sources do not say whether non-default configuration is required.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000745,"input_tokens":4626,"output_tokens":564,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126458':13A,16A '-2026':12A,15A '1':109C '8.5.0':27B,68C 'account':53B 'allow':77C 'alter':56B 'arbitrari':36B,84C 'attack':49B,88C,98C 'attacker-chosen':97C 'authent':79C 'author':6A,44B,59B,72C,83C,93C,108C 'authorizations_full.php':75C 'bill':38B,111C 'bypass':117C 'chosen':99C 'clinic':9A,57B,86C 'contain':69C 'csrf':104C 'cve':11A,14A 'form':39B,112C 'get':54B 'healthcar':18B 'host':24B 'let':28B 'log':31B 'logged-in':30B 'mark':35B 'member':34B 'miss':71C 'mode':92C 'note':40B 'openemr':1A,17A,19B,25B,66C 'packag':20B 'patient':8A,37B,61B,85C 'php':21B 'pid':100C 'pnote':113C 'provid':46B,118C 'record':10A,58B,87C,116C 'request':94C 'review':47B,119C 'self':23B 'self-host':22B 'send':90C 'set':107C 'skip':45B 'staff':3A,33B,52B,80C 'token':105C 'touch':65B 'transact':42B,115C 'user':4A,81C 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"OpenEMR installations before 8.5.0 where staff accounts exist. Any authenticated staff user can exploit the missing authorization check on authorizations_full.php, so deployments with only a single trusted user or no staff accounts are less exposed. Sources do not say whether non-default configuration is required.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["openemr"],"ptokens":["openemr"],"labels":["healthcare","high","openemr","package","php","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126458':13A,16A '-2026':12A,15A 'author':6A 'clinic':9A 'cve':11A,14A 'openemr':1A,17A 'patient':8A 'record':10A 'staff':3A 'user':4A","search_b":"'8.5.0':27B 'account':53B 'alter':56B 'arbitrari':36B 'attack':49B 'author':44B,59B 'bill':38B 'clinic':57B 'form':39B 'get':54B 'healthcar':18B 'host':24B 'let':28B 'log':31B 'logged-in':30B 'mark':35B 'member':34B 'note':40B 'openemr':19B,25B 'packag':20B 'patient':37B,61B 'php':21B 'provid':46B 'record':58B 'review':47B 'self':23B 'self-host':22B 'skip':45B 'staff':33B,52B 'touch':65B 'transact':42B","search_c":"'1':109C '8.5.0':68C 'allow':77C 'arbitrari':84C 'attack':88C,98C 'attacker-chosen':97C 'authent':79C 'author':72C,83C,93C,108C 'authorizations_full.php':75C 'bill':111C 'bypass':117C 'chosen':99C 'clinic':86C 'contain':69C 'csrf':104C 'form':112C 'miss':71C 'mode':92C 'openemr':66C 'patient':85C 'pid':100C 'pnote':113C 'provid':118C 'record':87C,116C 'request':94C 'review':119C 'send':90C 'set':107C 'staff':80C 'token':105C 'transact':115C 'user':81C 'vulner':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T22:45:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126458","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126458","severity":null,"published_at":"2026-11-13T10:17:54+00:00","modified_at":"2026-11-13T10:17:54+00:00","first_seen_at":"2026-11-13T10:47:24+00:00","fetched_at":"2026-11-13T10:47:24+00:00","note":null}],"documents":[{"id":145161,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-j467-662w-jwvj","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-27T22:45:22+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145162,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-authorizations-full-php","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}