{"id":"CVE-2026-126463","kind":"vulnerability","aliases":["CVE-2026-126463"],"related":[],"title":"OpenEMR: SQL injection lets logged-in users read password hashes and patient data","description":"OpenEMR before 8.5.0 contains multiple sql injection vulnerabilities that allow authenticated users to inject payloads through ERA CLP01, form_facility, form_icd_codes, and POST key names. Attackers can perform UNION, blind, and error-based injection to read users_secure password hashes and patient PHI, and overwrite patient_data fields.","summary":"OpenEMR, an electronic health records system, has several SQL injection flaws reachable through ERA CLP01, form_facility, form_icd_codes and POST key names. An authenticated user can read password hashes and patient health information and overwrite patient records.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","php","runtime","self-hosted"],"not_affected_if":["no-user-accounts-exposed","version-8.5.0-or-later"],"how_to_check":"- Check the installed OpenEMR version in the application's version file or admin footer; `unknown` if the sources do not say where.\n- Confirm whether the instance is reachable by users who hold any login account.","fix":"- OpenEMR: `8.5.0` or later","status":"open","published_at":"2026-11-13T10:17:54+00:00","first_seen_at":"2026-11-13T10:47:24+00:00","triaged_at":"2026-11-13T10:53:01+00:00","updated_at":"2026-11-13T10:53:01+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-13T10:53:01Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: `8.5.0` or later","reach":"network","title":"OpenEMR: SQL injection lets logged-in users read password hashes and patient data","impact":"high","summary":"OpenEMR, an electronic health records system, has several SQL injection flaws reachable through ERA CLP01, form_facility, form_icd_codes and POST key names. An authenticated user can read password hashes and patient health information and overwrite patient records.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads password hashes and patient records, and overwrites patient data","analyst_note":"","how_to_check":"- Check the installed OpenEMR version in the application's version file or admin footer; `unknown` if the sources do not say where.\n- Confirm whether the instance is reachable by users who hold any login account.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-8.5.0-or-later","no-user-accounts-exposed"],"who_is_affected":"Any OpenEMR instance before 8.5.0 is exposed to users who can log in, since the injection points sit behind authentication. Instances where only trusted staff have accounts carry less risk but still expose patient data to those users. Instances on a patched version can skip this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000722,"input_tokens":4617,"output_tokens":521,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126463':17A,20A '-2026':16A,19A '8.5.0':69C 'allow':76C 'attack':94C 'authent':53B,77C 'base':102C 'blind':98C 'clp01':42B,84C 'code':47B,89C 'contain':70C 'cve':15A,18A 'data':14A,116C 'electron':30B 'era':41B,83C 'error':101C 'error-bas':100C 'facil':44B,86C 'field':117C 'flaw':38B 'form':43B,45B,85C,87C 'hash':11A,58B,109C 'health':31B,61B 'healthcar':21B 'host':27B 'icd':46B,88C 'inform':62B 'inject':3A,37B,73C,80C,103C 'key':50B,92C 'let':4A 'log':6A 'logged-in':5A 'multipl':71C 'name':51B,93C 'openemr':1A,22B,28B,67C 'overwrit':64B,114C 'password':10A,57B,108C 'patient':13A,60B,65B,111C,115C 'payload':81C 'perform':96C 'phi':112C 'php':23B 'post':49B,91C 'reachabl':39B 'read':9A,56B,105C 'record':32B,66B 'runtim':24B 'secur':107C 'self':26B 'self-host':25B 'sever':35B 'sql':2A,36B,72C 'system':33B 'union':97C 'user':8A,54B,78C,106C 'vulner':74C","nicknames":[],"mitigations":[],"who_affected":"Any OpenEMR instance before 8.5.0 is exposed to users who can log in, since the injection points sit behind authentication. Instances where only trusted staff have accounts carry less risk but still expose patient data to those users. Instances on a patched version can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","php","runtime","selfhosted"],"campaign_type":null,"search_a":"'-126463':17A,20A '-2026':16A,19A 'cve':15A,18A 'data':14A 'hash':11A 'inject':3A 'let':4A 'log':6A 'logged-in':5A 'openemr':1A 'password':10A 'patient':13A 'read':9A 'sql':2A 'user':8A","search_b":"'authent':53B 'clp01':42B 'code':47B 'electron':30B 'era':41B 'facil':44B 'flaw':38B 'form':43B,45B 'hash':58B 'health':31B,61B 'healthcar':21B 'host':27B 'icd':46B 'inform':62B 'inject':37B 'key':50B 'name':51B 'openemr':22B,28B 'overwrit':64B 'password':57B 'patient':60B,65B 'php':23B 'post':49B 'reachabl':39B 'read':56B 'record':32B,66B 'runtim':24B 'self':26B 'self-host':25B 'sever':35B 'sql':36B 'system':33B 'user':54B","search_c":"'8.5.0':69C 'allow':76C 'attack':94C 'authent':77C 'base':102C 'blind':98C 'clp01':84C 'code':89C 'contain':70C 'data':116C 'era':83C 'error':101C 'error-bas':100C 'facil':86C 'field':117C 'form':85C,87C 'hash':109C 'icd':88C 'inject':73C,80C,103C 'key':92C 'multipl':71C 'name':93C 'openemr':67C 'overwrit':114C 'password':108C 'patient':111C,115C 'payload':81C 'perform':96C 'phi':112C 'post':91C 'read':105C 'secur':107C 'sql':72C 'union':97C 'user':78C,106C 'vulner':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:45:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126463","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126463","severity":null,"published_at":"2026-11-13T10:17:54+00:00","modified_at":"2026-11-13T10:17:55+00:00","first_seen_at":"2026-11-13T10:47:24+00:00","fetched_at":"2026-11-13T10:47:24+00:00","note":null}],"documents":[{"id":145169,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-g7m7-pc2p-7h7q","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:45:31+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145170,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-billing-parser-reports-zend-modules","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}