{"id":"CVE-2026-126470","kind":"vulnerability","aliases":["CVE-2026-126470"],"related":[],"title":"OpenEMR: Carecoordination flaw lets authenticated users read any patient's records","description":"OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the Carecoordination module that allows authenticated users with send_to_hie permission to access any patient's CCDA/CCR/QRDA documents. Attackers can supply arbitrary document or patient IDs to download, transmit, or export patient health records, inject falsified clinical data, and delete audit records.","summary":"OpenEMR before 8.5.0 has an insecure direct object reference in its Carecoordination module, so any user holding the send_to_hie permission can reach any patient's CCDA, CCR and QRDA documents by supplying arbitrary IDs. An attacker can download, transmit or export those health records, inject falsified clinical data, and delete audit records.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","other","self-hosted"],"not_affected_if":["no-send-to-hie-users","version-8.5.0-or-later"],"how_to_check":"- Check the installed OpenEMR version (`8.5.0` or later is the fixed line named in the advisory range).\n- Review which accounts hold the send_to_hie permission and whether any are shared or untrusted.","fix":"- OpenEMR: upgrade to `8.5.0` or later.","status":"open","published_at":"2026-11-13T10:17:56+00:00","first_seen_at":"2026-11-13T10:47:25+00:00","triaged_at":"2026-11-13T10:48:49+00:00","updated_at":"2026-11-13T10:48:49+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T10:48:49Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: upgrade to `8.5.0` or later.","reach":"network","title":"OpenEMR: Carecoordination flaw lets authenticated users read any patient's records","impact":"high","summary":"OpenEMR before 8.5.0 has an insecure direct object reference in its Carecoordination module, so any user holding the send_to_hie permission can reach any patient's CCDA, CCR and QRDA documents by supplying arbitrary IDs. An attacker can download, transmit or export those health records, inject falsified clinical data, and delete audit records.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","healthcare","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads, alters or deletes any patient's health records","analyst_note":"Confirm default permission assignment for send_to_hie and read the vendor advisory on github.com and the VulnCheck advisory for affected-version detail.","how_to_check":"- Check the installed OpenEMR version (`8.5.0` or later is the fixed line named in the advisory range).\n- Review which accounts hold the send_to_hie permission and whether any are shared or untrusted.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-8.5.0-or-later","no-send-to-hie-users"],"who_is_affected":"Any deployment of OpenEMR before 8.5.0 where users hold the send_to_hie permission in the Carecoordination module. Sites that do not grant that permission to anyone, or that run only current releases, are not exposed. unknown whether the sources describe default permission assignments.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000769,"input_tokens":4623,"output_tokens":613,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126470':14A,17A '-2026':13A,16A '8.5.0':26B,80C 'access':102C 'allow':93C 'arbitrari':58B,111C 'attack':61B,108C 'audit':76B,130C 'authent':5A,94C 'carecoordin':2A,35B,90C 'ccda':51B 'ccda/ccr/qrda':106C 'ccr':52B 'clinic':72B,126C 'contain':81C 'cve':12A,15A 'data':73B,127C 'delet':75B,129C 'direct':30B,84C 'document':55B,107C,112C 'download':63B,117C 'export':66B,120C 'falsifi':71B,125C 'flaw':3A 'health':68B,122C 'healthcar':18B 'hie':44B,99C 'hold':40B 'host':23B 'id':59B,115C 'inject':70B,124C 'insecur':29B,83C 'let':4A 'modul':36B,91C 'object':31B,85C 'openemr':1A,19B,24B,78C 'patient':9A,49B,104C,114C,121C 'permiss':45B,100C 'qrda':54B 'reach':47B 'read':7A 'record':11A,69B,77B,123C,131C 'refer':32B,86C 'self':22B 'self-host':21B 'send':42B,97C 'suppli':57B,110C 'transmit':64B,118C 'user':6A,39B,95C 'vulner':87C","nicknames":[],"mitigations":[],"who_affected":"Any deployment of OpenEMR before 8.5.0 where users hold the send_to_hie permission in the Carecoordination module. Sites that do not grant that permission to anyone, or that run only current releases, are not exposed. unknown whether the sources describe default permission assignments.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","other","selfhosted"],"campaign_type":null,"search_a":"'-126470':14A,17A '-2026':13A,16A 'authent':5A 'carecoordin':2A 'cve':12A,15A 'flaw':3A 'let':4A 'openemr':1A 'patient':9A 'read':7A 'record':11A 'user':6A","search_b":"'8.5.0':26B 'arbitrari':58B 'attack':61B 'audit':76B 'carecoordin':35B 'ccda':51B 'ccr':52B 'clinic':72B 'data':73B 'delet':75B 'direct':30B 'document':55B 'download':63B 'export':66B 'falsifi':71B 'health':68B 'healthcar':18B 'hie':44B 'hold':40B 'host':23B 'id':59B 'inject':70B 'insecur':29B 'modul':36B 'object':31B 'openemr':19B,24B 'patient':49B 'permiss':45B 'qrda':54B 'reach':47B 'record':69B,77B 'refer':32B 'self':22B 'self-host':21B 'send':42B 'suppli':57B 'transmit':64B 'user':39B","search_c":"'8.5.0':80C 'access':102C 'allow':93C 'arbitrari':111C 'attack':108C 'audit':130C 'authent':94C 'carecoordin':90C 'ccda/ccr/qrda':106C 'clinic':126C 'contain':81C 'data':127C 'delet':129C 'direct':84C 'document':107C,112C 'download':117C 'export':120C 'falsifi':125C 'health':122C 'hie':99C 'id':115C 'inject':124C 'insecur':83C 'modul':91C 'object':85C 'openemr':78C 'patient':104C,114C,121C 'permiss':100C 'record':123C,131C 'refer':86C 'send':97C 'suppli':110C 'transmit':118C 'user':95C 'vulner':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:41:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126470","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126470","severity":null,"published_at":"2026-11-13T10:17:56+00:00","modified_at":"2026-11-13T10:17:56+00:00","first_seen_at":"2026-11-13T10:47:25+00:00","fetched_at":"2026-11-13T10:47:25+00:00","note":null}],"documents":[{"id":145183,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-3vxh-7hh5-vhhm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:41:15+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145184,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-idor-in-carecoordination-ccda-ccr-qrda-document-actions","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}