{"id":"CVE-2026-126472","kind":"vulnerability","aliases":["CVE-2026-126472"],"related":[],"title":"OpenEMR: any staff login can read other patients' clinical records","description":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that allows any authenticated low-privilege staff user to retrieve other patients' C-CDA documents. Attackers can request the view or dl action with sequential pid values and their own CSRF token to enumerate and exfiltrate medications, problems, allergies, and immunizations.","summary":"OpenEMR, an electronic health records system, has a missing authorization check in its C-CDA gateway file ccdaservice/ccda_gateway.php. Any logged-in low-privilege staff user can request other patients' C-CDA documents by changing the patient ID, exposing medications, problems, allergies and immunizations.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","other","php","self-hosted"],"not_affected_if":["no-staff-logins-exposed","openemr-8.5.0-or-later"],"how_to_check":"- Check the installed OpenEMR version (unknown exact command; the sources do not say)\n- Look for the file `ccdaservice/ccda_gateway.php` in the OpenEMR install directory","fix":"- OpenEMR: move to `8.5.0` or later (the sources say 'before 8.5.0' is affected)","status":"open","published_at":"2026-11-13T10:17:56+00:00","first_seen_at":"2026-11-13T10:47:25+00:00","triaged_at":"2026-11-13T10:48:49+00:00","updated_at":"2026-11-13T10:48:49+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T10:48:49Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.5.0` or later (the sources say 'before 8.5.0' is affected)","reach":"network","title":"OpenEMR: any staff login can read other patients' clinical records","impact":"high","summary":"OpenEMR, an electronic health records system, has a missing authorization check in its C-CDA gateway file ccdaservice/ccda_gateway.php. Any logged-in low-privilege staff user can request other patients' C-CDA documents by changing the patient ID, exposing medications, problems, allergies and immunizations.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"any staff user reads other patients' clinical documents","analyst_note":"Confirm the affected version range and whether a patch or workaround beyond 8.5.0 is documented at the vendor advisory on github.com and the VulnCheck page.","how_to_check":"- Check the installed OpenEMR version (unknown exact command; the sources do not say)\n- Look for the file `ccdaservice/ccda_gateway.php` in the OpenEMR install directory","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["openemr-8.5.0-or-later","no-staff-logins-exposed"],"who_is_affected":"Clinics and hospitals that run OpenEMR themselves, where ordinary staff accounts can log in. Hosted or managed deployments depend on the operator's patch timing, and the sources do not say whether patient-facing portals are reachable through this route.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000764,"input_tokens":4635,"output_tokens":601,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126472':13A,16A '-2026':12A,15A '8.5.0':73C 'action':105C 'allergi':68B,121C 'allow':82C 'attack':98C 'authent':84C 'author':33B,77C 'c':38B,57B,95C 'c-cda':37B,56B,94C 'ccdaservice/ccda_gateway.php':42B,80C 'cda':39B,58B,96C 'chang':61B 'check':34B 'clinic':9A 'contain':74C 'csrf':113C 'cve':11A,14A 'dl':104C 'document':59B,97C 'electron':26B 'enumer':116C 'exfiltr':118C 'expos':65B 'file':41B 'gateway':40B 'health':27B 'healthcar':17B 'host':23B 'id':64B 'immun':70B,123C 'log':45B 'logged-in':44B 'login':4A 'low':48B,86C 'low-privileg':47B,85C 'medic':66B,119C 'miss':32B,76C 'openemr':1A,18B,24B,71C 'patient':8A,55B,63B,93C 'php':20B 'pid':108C 'privileg':49B,87C 'problem':67B,120C 'read':6A 'record':10A,28B 'request':53B,100C 'retriev':91C 'self':22B 'self-host':21B 'sequenti':107C 'staff':3A,50B,88C 'system':29B 'token':114C 'user':51B,89C 'valu':109C 'view':102C 'vulner':78C","nicknames":[],"mitigations":[],"who_affected":"Clinics and hospitals that run OpenEMR themselves, where ordinary staff accounts can log in. Hosted or managed deployments depend on the operator's patch timing, and the sources do not say whether patient-facing portals are reachable through this route.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","other","php","selfhosted"],"campaign_type":null,"search_a":"'-126472':13A,16A '-2026':12A,15A 'clinic':9A 'cve':11A,14A 'login':4A 'openemr':1A 'patient':8A 'read':6A 'record':10A 'staff':3A","search_b":"'allergi':68B 'author':33B 'c':38B,57B 'c-cda':37B,56B 'ccdaservice/ccda_gateway.php':42B 'cda':39B,58B 'chang':61B 'check':34B 'document':59B 'electron':26B 'expos':65B 'file':41B 'gateway':40B 'health':27B 'healthcar':17B 'host':23B 'id':64B 'immun':70B 'log':45B 'logged-in':44B 'low':48B 'low-privileg':47B 'medic':66B 'miss':32B 'openemr':18B,24B 'patient':55B,63B 'php':20B 'privileg':49B 'problem':67B 'record':28B 'request':53B 'self':22B 'self-host':21B 'staff':50B 'system':29B 'user':51B","search_c":"'8.5.0':73C 'action':105C 'allergi':121C 'allow':82C 'attack':98C 'authent':84C 'author':77C 'c':95C 'c-cda':94C 'ccdaservice/ccda_gateway.php':80C 'cda':96C 'contain':74C 'csrf':113C 'dl':104C 'document':97C 'enumer':116C 'exfiltr':118C 'immun':123C 'low':86C 'low-privileg':85C 'medic':119C 'miss':76C 'openemr':71C 'patient':93C 'pid':108C 'privileg':87C 'problem':120C 'request':100C 'retriev':91C 'sequenti':107C 'staff':88C 'token':114C 'user':89C 'valu':109C 'view':102C 'vulner':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:36:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126472","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126472","severity":null,"published_at":"2026-11-13T10:17:56+00:00","modified_at":"2026-11-13T10:17:56+00:00","first_seen_at":"2026-11-13T10:47:25+00:00","fetched_at":"2026-11-13T10:47:25+00:00","note":null}],"documents":[{"id":145187,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-6fxw-69cq-m7g6","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:36:52+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145188,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-ccdaservice-ccda-gateway-php-c-cda-disclosure","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}