OPENEMR · CVE-2026-126471 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 has a missing authorization check in print_referral.php and trend_form.php. A low-privileged Front Office user can request these pages with any patient_id and retrieve demographics, insurance data and vitals history.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Clinics and organizations running self-hosted OpenEMR before 8.5.0 where Front Office accounts exist. The flaw lets those accounts reach patient data without the patients:med permission, so deployments with only admin or fully trusted staff are less exposed. Unknown whether the sources list other conditions.
Not affected if no-front-office-users, openemr-8.5.0-or-later
Who cares healthcare, openemr, php, self-hosted
8.5.0.8.5.0 or later (per the NVD description, fixed in versions before 8.5.0 are affected).OpenEMR before 8.5.0 contains a missing authorization vulnerability in print_referral.php and trend_form.php that allows low-privileged Front Office users to access patient PHI without patients:med permission. Attackers can directly request these endpoints with arbitrary patient_id values to retrieve patient demographics, insurance data, and vitals history, enumerating IDs to expand disclosure.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.