CVE-2026-126485 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 has a cross-site request forgery flaw in its observation delete handler, which accepts no CSRF token. An attacker who lures a logged-in clinician to a crafted page can soft-delete observation form records in that clinician's open encounter.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
OpenEMR installations before 8.5.0 where clinicians use the observation forms while logged in. Exposure depends on a logged-in user visiting an attacker-controlled page, so the risk is highest for clinicians who browse other sites during sessions.
Not affected if openemr-8.5.0-or-later
Who cares healthcare, openemr, self-hosted
unknown is what the sources give for the exact check command.8.5.0 or later.OpenEMR before 8.5.0 contains a cross-site request forgery vulnerability in ObservationController::deleteAction that allows attackers to delete observation form records without a CSRF token. Attackers can lure a logged-in clinician to a page issuing a GET to delete.php with guessed id values, soft-deleting observations in the victim's open encounter.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.