OPENEMR · CVE-2026-126469 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR versions before 8.5.0 have several custom scripts that check only that a user is logged in and never run the access control check. Any logged-in low-privilege user can download patient SSNs, dates of birth, insurance data and provider identifiers, and can forge chart-tracker records.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any OpenEMR deployment before 8.5.0 that exposes these custom scripts to authenticated users. Anyone with a low-privilege login can reach patient data, so the exposure depends on how many staff hold accounts. Installations on 8.5.0 or later are not affected by this issue.
Not affected if openemr-8.5.0-or-later
Who cares healthcare, openemr, self-hosted
8.5.0 are affected.custom/export_labworks.php, custom/chart_tracker.php and custom/export_registry_xml.php in the install.8.5.0 or later, per the sources.OpenEMR before 8.5.0 contains a missing authorization vulnerability in several custom/ scripts that rely only on session authentication and never call AclMain::aclCheckCore(). Any authenticated low-privilege user can request export_labworks.php, chart_tracker.php, or export_registry_xml.php to disclose patient SSN, DOB, and insurance data or provider NPI/tax IDs, and forge chart-tracker records.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.