---
id: "CVE-2026-126480"
page: "https://infrastack.ai/live/CVE-2026-126480"
kind: "vulnerability"
aliases: ["CVE-2026-126480"]
title: "OpenEMR: SQL injection in CCR approval lets users read password hashes"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["healthcare", "openemr", "other", "self-hosted"]
not_affected_if: ["openemr-8.5.0-or-later"]
published_at: "2026-11-13T10:17:57+00:00"
first_seen_at: "2026-11-13T10:47:25+00:00"
updated_at: "2026-11-13T10:50:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126480", "first_seen_at": "2026-11-13T10:47:25+00:00"}]
exploit_sources: []
---

# OpenEMR: SQL injection in CCR approval lets users read password hashes

Link for people: https://infrastack.ai/live/CVE-2026-126480 (this .md is for agents)

OpenEMR before 8.5.0 has a SQL injection flaw in the CCR approval code, where request parameter names are used as database column names. An authenticated user can craft requests to copy password hashes into patient fields or corrupt patient records.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenEMR version in the installed application; versions before `8.5.0` are listed as affected.
- Review whether the `revandapprove` route is reachable by users who are not clinical staff.

## Fix

- OpenEMR: move to `8.5.0` or later.

## Timeline

- 2026-11-13T10:47:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126480

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openemr/openemr/security/advisories/GHSA-86hf-j825-r56h
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-ccr-revandapprove-parameter-names

## From the sources

OpenEMR before 8.5.0 contains an sql injection vulnerability in CcrTable::insertApprovedData() that allows authenticated users to inject SQL through request parameter names used as column names. Attackers can send crafted patient_data-*-sel parameters to the revandapprove route, lacking ACL and CSRF checks, to copy password hashes into patient fields or corrupt records.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_