CVE-2026-126472 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR, an electronic health records system, has a missing authorization check in its C-CDA gateway file ccdaservice/ccda_gateway.php. Any logged-in low-privilege staff user can request other patients' C-CDA documents by changing the patient ID, exposing medications, problems, allergies and immunizations.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Clinics and hospitals that run OpenEMR themselves, where ordinary staff accounts can log in. Hosted or managed deployments depend on the operator's patch timing, and the sources do not say whether patient-facing portals are reachable through this route.
Not affected if no-staff-logins-exposed, openemr-8.5.0-or-later
Who cares healthcare, openemr, php, self-hosted
ccdaservice/ccda_gateway.php in the OpenEMR install directory8.5.0 or later (the sources say 'before 8.5.0' is affected)OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that allows any authenticated low-privilege staff user to retrieve other patients' C-CDA documents. Attackers can request the view or dl action with sequential pid values and their own CSRF token to enumerate and exfiltrate medications, problems, allergies, and immunizations.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.