{"id":"CVE-2026-126466","kind":"vulnerability","aliases":["CVE-2026-126466"],"related":[],"title":"OpenEMR: missing access checks let any logged-in user leak patient records","description":"OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated user to create patient records and enumerate patients by omitting aclCheckCore() checks. Attackers can POST to new_comprehensive_save.php to create patients with insurance PHI, or query new_search_popup.php and patient_select.php to leak names, SSNs and DOBs.","summary":"OpenEMR versions before 8.5.0 skip authorization checks in several patient-handling pages, so any authenticated user can create patient records. The same flaw lets them search and enumerate patients, exposing names, SSNs and dates of birth.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","other","phi","self-hosted"],"not_affected_if":["openemr-8.5.0-or-later"],"how_to_check":"- Check the installed OpenEMR version against the fixed release listed in the vendor advisory (`8.5.0`)","fix":"- OpenEMR: upgrade to `8.5.0` or later","status":"open","published_at":"2026-11-13T10:17:55+00:00","first_seen_at":"2026-11-13T10:47:24+00:00","triaged_at":"2026-11-13T10:48:54+00:00","updated_at":"2026-11-13T10:48:54+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-13T10:48:54Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: upgrade to `8.5.0` or later","reach":"network","title":"OpenEMR: missing access checks let any logged-in user leak patient records","impact":"high","summary":"OpenEMR versions before 8.5.0 skip authorization checks in several patient-handling pages, so any authenticated user can create patient records. The same flaw lets them search and enumerate patients, exposing names, SSNs and dates of birth.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","phi"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads patient SSNs and dates of birth, and creates patient records.","analyst_note":"Confirm the affected version range and the fixed release from the vendor advisory at github.com; the sources give only 'before 8.5.0'.","how_to_check":"- Check the installed OpenEMR version against the fixed release listed in the vendor advisory (`8.5.0`)\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["openemr-8.5.0-or-later"],"who_is_affected":"Any OpenEMR deployment older than 8.5.0 where users hold ordinary logins is exposed, because the flaw needs only an authenticated account and no special setup. Deployments that restrict who can log in to trusted staff still carry the risk from any compromised account. unknown whether any configuration narrows the exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000745,"input_tokens":4619,"output_tokens":567,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126466':16A,19A '-2026':15A,18A '8.5.0':30B,66C 'access':3A 'aclcheckcor':86C 'allow':73C 'attack':88C 'authent':42B,75C 'author':32B,70C 'birth':63B 'check':4A,33B,87C 'contain':67C 'creat':45B,78C,94C 'cve':14A,17A 'date':61B 'dob':109C 'enumer':55B,82C 'expos':57B 'flaw':50B 'handl':38B 'healthcar':20B 'host':26B 'insur':97C 'leak':11A,105C 'let':5A,51B 'log':8A 'logged-in':7A 'miss':2A,69C 'name':58B,106C 'new_comprehensive_save.php':92C 'new_search_popup.php':101C 'omit':85C 'openemr':1A,21B,27B,64C 'page':39B 'patient':12A,37B,46B,56B,79C,83C,95C 'patient-handl':36B 'patient_select.php':103C 'phi':23B,98C 'post':90C 'queri':100C 'record':13A,47B,80C 'search':53B 'self':25B 'self-host':24B 'sever':35B 'skip':31B 'ssns':59B,107C 'user':10A,43B,76C 'version':28B 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Any OpenEMR deployment older than 8.5.0 where users hold ordinary logins is exposed, because the flaw needs only an authenticated account and no special setup. Deployments that restrict who can log in to trusted staff still carry the risk from any compromised account. unknown whether any configuration narrows the exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","other","phi","selfhosted"],"campaign_type":null,"search_a":"'-126466':16A,19A '-2026':15A,18A 'access':3A 'check':4A 'cve':14A,17A 'leak':11A 'let':5A 'log':8A 'logged-in':7A 'miss':2A 'openemr':1A 'patient':12A 'record':13A 'user':10A","search_b":"'8.5.0':30B 'authent':42B 'author':32B 'birth':63B 'check':33B 'creat':45B 'date':61B 'enumer':55B 'expos':57B 'flaw':50B 'handl':38B 'healthcar':20B 'host':26B 'let':51B 'name':58B 'openemr':21B,27B 'page':39B 'patient':37B,46B,56B 'patient-handl':36B 'phi':23B 'record':47B 'search':53B 'self':25B 'self-host':24B 'sever':35B 'skip':31B 'ssns':59B 'user':43B 'version':28B","search_c":"'8.5.0':66C 'aclcheckcor':86C 'allow':73C 'attack':88C 'authent':75C 'author':70C 'check':87C 'contain':67C 'creat':78C,94C 'dob':109C 'enumer':82C 'insur':97C 'leak':105C 'miss':69C 'name':106C 'new_comprehensive_save.php':92C 'new_search_popup.php':101C 'omit':85C 'openemr':64C 'patient':79C,83C,95C 'patient_select.php':103C 'phi':98C 'post':90C 'queri':100C 'record':80C 'ssns':107C 'user':76C 'vulner':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:19:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126466","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126466","severity":null,"published_at":"2026-11-13T10:17:55+00:00","modified_at":"2026-11-13T10:17:55+00:00","first_seen_at":"2026-11-13T10:47:24+00:00","fetched_at":"2026-11-13T10:47:24+00:00","note":null}],"documents":[{"id":145175,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-cwpg-qv34-gx8x","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:19:09+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145176,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-patient-create-and-search-endpoints","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}