{"id":"CVE-2026-126480","kind":"vulnerability","aliases":["CVE-2026-126480"],"related":[],"title":"OpenEMR: SQL injection in CCR approval lets users read password hashes","description":"OpenEMR before 8.5.0 contains an sql injection vulnerability in CcrTable::insertApprovedData() that allows authenticated users to inject SQL through request parameter names used as column names. Attackers can send crafted patient_data-*-sel parameters to the revandapprove route, lacking ACL and CSRF checks, to copy password hashes into patient fields or corrupt records.","summary":"OpenEMR before 8.5.0 has a SQL injection flaw in the CCR approval code, where request parameter names are used as database column names. An authenticated user can craft requests to copy password hashes into patient fields or corrupt patient records.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","other","self-hosted"],"not_affected_if":["openemr-8.5.0-or-later"],"how_to_check":"- Check the OpenEMR version in the installed application; versions before `8.5.0` are listed as affected.\n- Review whether the `revandapprove` route is reachable by users who are not clinical staff.","fix":"- OpenEMR: move to `8.5.0` or later.","status":"open","published_at":"2026-11-13T10:17:57+00:00","first_seen_at":"2026-11-13T10:47:25+00:00","triaged_at":"2026-11-13T10:50:44+00:00","updated_at":"2026-11-13T10:50:44+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-13T10:50:44Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.5.0` or later.","reach":"network","title":"OpenEMR: SQL injection in CCR approval lets users read password hashes","impact":"high","summary":"OpenEMR before 8.5.0 has a SQL injection flaw in the CCR approval code, where request parameter names are used as database column names. An authenticated user can craft requests to copy password hashes into patient fields or corrupt patient records.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","healthcare","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads password hashes and corrupts patient records in the database.","analyst_note":"","how_to_check":"- Check the OpenEMR version in the installed application; versions before `8.5.0` are listed as affected.\n- Review whether the `revandapprove` route is reachable by users who are not clinical staff.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["openemr-8.5.0-or-later"],"who_is_affected":"Sites running OpenEMR before 8.5.0 where authenticated users can reach the CCR review and approval route. The sources say the route lacks ACL and CSRF checks, so any logged-in user may be able to exploit it. Sites with no user accounts beyond trusted staff face lower risk but should still upgrade.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000724,"input_tokens":4628,"output_tokens":523,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126480':14A,17A '-2026':13A,16A '8.5.0':26B,66C 'acl':103C 'allow':76C 'approv':6A,35B 'attack':90C 'authent':48B,77C 'ccr':5A,34B 'ccrtabl':73C 'check':106C 'code':36B 'column':45B,88C 'contain':67C 'copi':54B,108C 'corrupt':61B,115C 'craft':51B,93C 'csrf':105C 'cve':12A,15A 'data':95C 'databas':44B 'field':59B,113C 'flaw':31B 'hash':11A,56B,110C 'healthcar':18B 'host':23B 'inject':3A,30B,70C,80C 'insertapproveddata':74C 'lack':102C 'let':7A 'name':40B,46B,85C,89C 'openemr':1A,19B,24B,64C 'paramet':39B,84C,97C 'password':10A,55B,109C 'patient':58B,62B,94C,112C 'read':9A 'record':63B,116C 'request':38B,52B,83C 'revandapprov':100C 'rout':101C 'sel':96C 'self':22B 'self-host':21B 'send':92C 'sql':2A,29B,69C,81C 'use':42B,86C 'user':8A,49B,78C 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Sites running OpenEMR before 8.5.0 where authenticated users can reach the CCR review and approval route. The sources say the route lacks ACL and CSRF checks, so any logged-in user may be able to exploit it. Sites with no user accounts beyond trusted staff face lower risk but should still upgrade.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","other","selfhosted"],"campaign_type":null,"search_a":"'-126480':14A,17A '-2026':13A,16A 'approv':6A 'ccr':5A 'cve':12A,15A 'hash':11A 'inject':3A 'let':7A 'openemr':1A 'password':10A 'read':9A 'sql':2A 'user':8A","search_b":"'8.5.0':26B 'approv':35B 'authent':48B 'ccr':34B 'code':36B 'column':45B 'copi':54B 'corrupt':61B 'craft':51B 'databas':44B 'field':59B 'flaw':31B 'hash':56B 'healthcar':18B 'host':23B 'inject':30B 'name':40B,46B 'openemr':19B,24B 'paramet':39B 'password':55B 'patient':58B,62B 'record':63B 'request':38B,52B 'self':22B 'self-host':21B 'sql':29B 'use':42B 'user':49B","search_c":"'8.5.0':66C 'acl':103C 'allow':76C 'attack':90C 'authent':77C 'ccrtabl':73C 'check':106C 'column':88C 'contain':67C 'copi':108C 'corrupt':115C 'craft':93C 'csrf':105C 'data':95C 'field':113C 'hash':110C 'inject':70C,80C 'insertapproveddata':74C 'lack':102C 'name':85C,89C 'openemr':64C 'paramet':84C,97C 'password':109C 'patient':94C,112C 'record':116C 'request':83C 'revandapprov':100C 'rout':101C 'sel':96C 'send':92C 'sql':69C,81C 'use':86C 'user':78C 'vulner':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:34:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126480","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126480","severity":null,"published_at":"2026-11-13T10:17:57+00:00","modified_at":"2026-11-13T10:17:57+00:00","first_seen_at":"2026-11-13T10:47:25+00:00","fetched_at":"2026-11-13T10:47:25+00:00","note":null}],"documents":[{"id":145203,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-86hf-j825-r56h","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:34:35+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145204,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-ccr-revandapprove-parameter-names","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}