CVE-2026-126470 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 has an insecure direct object reference in its Carecoordination module, so any user holding the send_to_hie permission can reach any patient's CCDA, CCR and QRDA documents by supplying arbitrary IDs. An attacker can download, transmit or export those health records, inject falsified clinical data, and delete audit records.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any deployment of OpenEMR before 8.5.0 where users hold the send_to_hie permission in the Carecoordination module. Sites that do not grant that permission to anyone, or that run only current releases, are not exposed. unknown whether the sources describe default permission assignments.
Not affected if no-send-to-hie-users, version-8.5.0-or-later
Who cares healthcare, openemr, self-hosted
8.5.0 or later is the fixed line named in the advisory range).8.5.0 or later.OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the Carecoordination module that allows authenticated users with send_to_hie permission to access any patient's CCDA/CCR/QRDA documents. Attackers can supply arbitrary document or patient IDs to download, transmit, or export patient health records, inject falsified clinical data, and delete audit records.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.