{"id":"CVE-2026-126478","kind":"vulnerability","aliases":["CVE-2026-126478"],"related":[],"title":"OpenEMR: SQL injection in Syndromic Surveillance report exposes patient records","description":"OpenEMR before 8.5.0 contains an SQL injection vulnerability in the Syndromic Surveillance report because the form_icd_codes[] POST array is concatenated into an unquoted numeric IN() clause without integer validation. Authenticated users can submit quote-free payloads that bypass add_escape_custom to perform blind or UNION-based injection and exfiltrate patient health information.","summary":"OpenEMR before 8.5.0 concatenates the form_icd_codes[] POST array into an unquoted numeric IN() clause without integer validation in the Syndromic Surveillance report. An authenticated user can send quote-free payloads to run blind or UNION-based SQL injection and extract patient health information.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","other","php","self-hosted"],"not_affected_if":["no-syndromic-surveillance-report","version-8.5.0-or-later"],"how_to_check":"- Check the installed OpenEMR version in the application footer or `version.php` and compare it with the fixed range.\n- Confirm whether the Syndromic Surveillance report is in use on the deployment.","fix":"- OpenEMR: move to `8.5.0` or later (the fixed version named in the NVD range for this CVE).","status":"open","published_at":"2026-11-13T10:17:57+00:00","first_seen_at":"2026-11-13T10:47:25+00:00","triaged_at":"2026-11-13T10:52:40+00:00","updated_at":"2026-11-13T10:52:40+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T10:52:40Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.5.0` or later (the fixed version named in the NVD range for this CVE).","reach":"network","title":"OpenEMR: SQL injection in Syndromic Surveillance report exposes patient records","impact":"high","summary":"OpenEMR before 8.5.0 concatenates the form_icd_codes[] POST array into an unquoted numeric IN() clause without integer validation in the Syndromic Surveillance report. An authenticated user can send quote-free payloads to run blind or UNION-based SQL injection and extract patient health information.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"patient health information exfiltrated from the database by authenticated users","analyst_note":"Confirm the fixed version and any workaround in the vendor advisory at github.com and the VulnCheck advisory; the NVD entry gives no product range data.","how_to_check":"- Check the installed OpenEMR version in the application footer or `version.php` and compare it with the fixed range.\n- Confirm whether the Syndromic Surveillance report is in use on the deployment.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-8.5.0-or-later","no-syndromic-surveillance-report"],"who_is_affected":"OpenEMR installations before 8.5.0 that expose the Syndromic Surveillance report to users with login accounts. Exposure depends on the report being reachable by authenticated users, so instances where only trusted staff can log in carry less immediate risk but still need patching. Deployments already on 8.5.0 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000779,"input_tokens":4628,"output_tokens":633,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126478':13A,16A '-2026':12A,15A '8.5.0':26B,73C 'add':112C 'array':33B,90C 'authent':49B,102C 'base':63B,121C 'blind':59B,117C 'bypass':111C 'claus':39B,98C 'code':31B,88C 'concaten':27B,92C 'contain':74C 'custom':114C 'cve':11A,14A 'escap':113C 'exfiltr':124C 'expos':8A 'extract':67B 'form':29B,86C 'free':55B,108C 'health':69B,126C 'healthcar':17B 'host':23B 'icd':30B,87C 'inform':70B,127C 'inject':3A,65B,77C,122C 'integ':41B,100C 'numer':37B,96C 'openemr':1A,18B,24B,71C 'patient':9A,68B,125C 'payload':56B,109C 'perform':116C 'php':20B 'post':32B,89C 'quot':54B,107C 'quote-fre':53B,106C 'record':10A 'report':7A,47B,83C 'run':58B 'self':22B 'self-host':21B 'send':52B 'sql':2A,64B,76C 'submit':105C 'surveil':6A,46B,82C 'syndrom':5A,45B,81C 'union':62B,120C 'union-bas':61B,119C 'unquot':36B,95C 'user':50B,103C 'valid':42B,101C 'vulner':78C 'without':40B,99C","nicknames":[],"mitigations":[],"who_affected":"OpenEMR installations before 8.5.0 that expose the Syndromic Surveillance report to users with login accounts. Exposure depends on the report being reachable by authenticated users, so instances where only trusted staff can log in carry less immediate risk but still need patching. Deployments already on 8.5.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","other","php","selfhosted"],"campaign_type":null,"search_a":"'-126478':13A,16A '-2026':12A,15A 'cve':11A,14A 'expos':8A 'inject':3A 'openemr':1A 'patient':9A 'record':10A 'report':7A 'sql':2A 'surveil':6A 'syndrom':5A","search_b":"'8.5.0':26B 'array':33B 'authent':49B 'base':63B 'blind':59B 'claus':39B 'code':31B 'concaten':27B 'extract':67B 'form':29B 'free':55B 'health':69B 'healthcar':17B 'host':23B 'icd':30B 'inform':70B 'inject':65B 'integ':41B 'numer':37B 'openemr':18B,24B 'patient':68B 'payload':56B 'php':20B 'post':32B 'quot':54B 'quote-fre':53B 'report':47B 'run':58B 'self':22B 'self-host':21B 'send':52B 'sql':64B 'surveil':46B 'syndrom':45B 'union':62B 'union-bas':61B 'unquot':36B 'user':50B 'valid':42B 'without':40B","search_c":"'8.5.0':73C 'add':112C 'array':90C 'authent':102C 'base':121C 'blind':117C 'bypass':111C 'claus':98C 'code':88C 'concaten':92C 'contain':74C 'custom':114C 'escap':113C 'exfiltr':124C 'form':86C 'free':108C 'health':126C 'icd':87C 'inform':127C 'inject':77C,122C 'integ':100C 'numer':96C 'openemr':71C 'patient':125C 'payload':109C 'perform':116C 'post':89C 'quot':107C 'quote-fre':106C 'report':83C 'sql':76C 'submit':105C 'surveil':82C 'syndrom':81C 'union':120C 'union-bas':119C 'unquot':95C 'user':103C 'valid':101C 'vulner':78C 'without':99C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:33:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126478","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126478","severity":null,"published_at":"2026-11-13T10:17:57+00:00","modified_at":"2026-11-13T10:17:57+00:00","first_seen_at":"2026-11-13T10:47:25+00:00","fetched_at":"2026-11-13T10:47:25+00:00","note":null}],"documents":[{"id":145199,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-q6f8-4pm7-q39r","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:33:11+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145200,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-form-icd-codes-in-syndromic-surveillance","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}