CVE-2026-126466 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR versions before 8.5.0 skip authorization checks in several patient-handling pages, so any authenticated user can create patient records. The same flaw lets them search and enumerate patients, exposing names, SSNs and dates of birth.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any OpenEMR deployment older than 8.5.0 where users hold ordinary logins is exposed, because the flaw needs only an authenticated account and no special setup. Deployments that restrict who can log in to trusted staff still carry the risk from any compromised account. unknown whether any configuration narrows the exposure.
Not affected if openemr-8.5.0-or-later
Who cares healthcare, openemr, phi, self-hosted
8.5.0)8.5.0 or laterOpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated user to create patient records and enumerate patients by omitting aclCheckCore() checks. Attackers can POST to new_comprehensive_save.php to create patients with insurance PHI, or query new_search_popup.php and patient_select.php to leak names, SSNs and DOBs.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.