CVE-2026-126480 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 has a SQL injection flaw in the CCR approval code, where request parameter names are used as database column names. An authenticated user can craft requests to copy password hashes into patient fields or corrupt patient records.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running OpenEMR before 8.5.0 where authenticated users can reach the CCR review and approval route. The sources say the route lacks ACL and CSRF checks, so any logged-in user may be able to exploit it. Sites with no user accounts beyond trusted staff face lower risk but should still upgrade.
Not affected if openemr-8.5.0-or-later
Who cares healthcare, openemr, self-hosted
8.5.0 are listed as affected.revandapprove route is reachable by users who are not clinical staff.8.5.0 or later.OpenEMR before 8.5.0 contains an sql injection vulnerability in CcrTable::insertApprovedData() that allows authenticated users to inject SQL through request parameter names used as column names. Attackers can send crafted patient_data-*-sel parameters to the revandapprove route, lacking ACL and CSRF checks, to copy password hashes into patient fields or corrupt records.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.