{"id":"CVE-2026-126465","kind":"vulnerability","aliases":["CVE-2026-126465"],"related":[],"title":"OpenEMR: SQL injection in patient portal lets staff read PHI and hashes","description":"OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal api/onsiteactivityviews endpoint that allows any authenticated staff user to inject SQL through unquoted Id_BitwiseAnd Criteria values. Attackers can close the bitwise parenthesis and append OR or UNION SELECT clauses to read patient PHI, staff password hashes, MySQL authentication strings, and API tokens.","summary":"OpenEMR, an electronic health records system, has an SQL injection flaw in its patient portal api/onsiteactivityviews endpoint, fixed in version 8.5.0. Any authenticated staff user can inject SQL and read patient health data, staff password hashes, MySQL credentials and API tokens.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","other","php","self-hosted"],"not_affected_if":["no-staff-accounts-untrusted","openemr-8.5.0-or-later"],"how_to_check":"- Check the installed OpenEMR version; versions before `8.5.0` are affected.\n- Confirm whether the patient portal and the `api/onsiteactivityviews` endpoint are enabled on the deployment.","fix":"- Upgrade OpenEMR to `8.5.0` or later.","status":"open","published_at":"2026-11-13T10:17:55+00:00","first_seen_at":"2026-11-13T10:47:24+00:00","triaged_at":"2026-11-13T10:52:59+00:00","updated_at":"2026-11-13T10:52:59+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-13T10:52:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenEMR to `8.5.0` or later.","reach":"network","title":"OpenEMR: SQL injection in patient portal lets staff read PHI and hashes","impact":"high","summary":"OpenEMR, an electronic health records system, has an SQL injection flaw in its patient portal api/onsiteactivityviews endpoint, fixed in version 8.5.0. Any authenticated staff user can inject SQL and read patient health data, staff password hashes, MySQL credentials and API tokens.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","php"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads patient records, password hashes and database credentials","analyst_note":"","how_to_check":"- Check the installed OpenEMR version; versions before `8.5.0` are affected.\n- Confirm whether the patient portal and the `api/onsiteactivityviews` endpoint are enabled on the deployment.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["openemr-8.5.0-or-later","no-staff-accounts-untrusted"],"who_is_affected":"Organizations running OpenEMR before 8.5.0 with the patient portal API reachable. Exploitation needs a valid staff account, so exposure depends on who holds staff logins. Deployments already on 8.5.0 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000739,"input_tokens":4652,"output_tokens":547,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126465':15A,18A '-2026':14A,17A '8.5.0':46B,69C 'allow':82C 'api':65B,120C 'api/onsiteactivityviews':41B,79C 'append':103C 'attack':96C 'authent':48B,84C,117C 'bitwis':100C 'bitwiseand':93C 'claus':108C 'close':98C 'contain':70C 'credenti':63B 'criteria':94C 'cve':13A,16A 'data':58B 'electron':28B 'endpoint':42B,80C 'fix':43B 'flaw':36B 'hash':12A,61B,115C 'health':29B,57B 'healthcar':19B 'host':25B 'id':92C 'inject':3A,35B,52B,73C,88C 'let':7A 'mysql':62B,116C 'openemr':1A,20B,26B,67C 'parenthesi':101C 'password':60B,114C 'patient':5A,39B,56B,77C,111C 'phi':10A,112C 'php':22B 'portal':6A,40B,78C 'read':9A,55B,110C 'record':30B 'select':107C 'self':24B 'self-host':23B 'sql':2A,34B,53B,72C,89C 'staff':8A,49B,59B,85C,113C 'string':118C 'system':31B 'token':66B,121C 'union':106C 'unquot':91C 'user':50B,86C 'valu':95C 'version':45B 'vulner':74C","nicknames":[],"mitigations":[],"who_affected":"Organizations running OpenEMR before 8.5.0 with the patient portal API reachable. Exploitation needs a valid staff account, so exposure depends on who holds staff logins. Deployments already on 8.5.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","other","php","selfhosted"],"campaign_type":null,"search_a":"'-126465':15A,18A '-2026':14A,17A 'cve':13A,16A 'hash':12A 'inject':3A 'let':7A 'openemr':1A 'patient':5A 'phi':10A 'portal':6A 'read':9A 'sql':2A 'staff':8A","search_b":"'8.5.0':46B 'api':65B 'api/onsiteactivityviews':41B 'authent':48B 'credenti':63B 'data':58B 'electron':28B 'endpoint':42B 'fix':43B 'flaw':36B 'hash':61B 'health':29B,57B 'healthcar':19B 'host':25B 'inject':35B,52B 'mysql':62B 'openemr':20B,26B 'password':60B 'patient':39B,56B 'php':22B 'portal':40B 'read':55B 'record':30B 'self':24B 'self-host':23B 'sql':34B,53B 'staff':49B,59B 'system':31B 'token':66B 'user':50B 'version':45B","search_c":"'8.5.0':69C 'allow':82C 'api':120C 'api/onsiteactivityviews':79C 'append':103C 'attack':96C 'authent':84C,117C 'bitwis':100C 'bitwiseand':93C 'claus':108C 'close':98C 'contain':70C 'criteria':94C 'endpoint':80C 'hash':115C 'id':92C 'inject':73C,88C 'mysql':116C 'openemr':67C 'parenthesi':101C 'password':114C 'patient':77C,111C 'phi':112C 'portal':78C 'read':110C 'select':107C 'sql':72C,89C 'staff':85C,113C 'string':118C 'token':121C 'union':106C 'unquot':91C 'user':86C 'valu':95C 'vulner':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T22:40:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126465","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126465","severity":null,"published_at":"2026-11-13T10:17:55+00:00","modified_at":"2026-11-13T10:17:55+00:00","first_seen_at":"2026-11-13T10:47:24+00:00","fetched_at":"2026-11-13T10:47:24+00:00","note":null}],"documents":[{"id":145173,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-vvj8-xpx8-p293","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-27T22:40:39+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145174,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-onsiteactivityview-bitwiseand-criteria","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}