OPENEMR · CVE-2026-126467 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 has a mass assignment flaw in its observation save handler, where an incomplete field blacklist lets a logged-in low-privilege user set the authorized flag and overwrite the id. An attacker can mark observations as signed by a provider and alter clinical fields of other observations in the same patient encounter.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any deployment of OpenEMR before 8.5.0 where users with low-privilege accounts can save observation forms. The risk is to clinical record integrity inside a patient encounter, so healthcare organizations running self-hosted OpenEMR should prioritize it. Installations already on 8.5.0 or later are not affected.
Not affected if no-authenticated-low-privilege-users, openemr-8.5.0-or-later
Who cares healthcare, openemr, php, self-hosted
8.5.0 or later is not affected per the NVD description; anything earlier is).8.5.0 or later.OpenEMR before 8.5.0 contains a mass assignment vulnerability in ObservationController::processEnhancedFormSave() that allows authenticated low-privilege users to forge authorization flags through an incomplete field blacklist. Attackers can submit authorized=1 or override the id field alongside observation_id to mark observations as Provider-signed and overwrite clinical fields of other observations within the same patient encounter.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.