CVE-2026-126488 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 has an SQL injection flaw in the patient portal OnsiteDocument.Query endpoint, where the _BitwiseAnd parameters go into SQL unquoted. An authenticated patient can read the whole database, including other patients' records and staff password hashes.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any OpenEMR deployment before 8.5.0 with the patient portal enabled is exposed, because the flaw is reached through a portal patient account. Deployments without the patient portal, or on 8.5.0 or later, are not affected. The sources do not say whether the portal is on by default.
Not affected if portal-disabled, version-8.5.0-or-later
Who cares healthcare, openemr, patient-portal, self-hosted
8.5.08.5.0 or laterOpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal OnsiteDocument.Query endpoint, where mass-assigned _BitwiseAnd criteria parameters are placed unquoted into SQL with only quote-character escaping. Authenticated portal patients can inject SQL outside their per-patient scope to read the entire database, including other patients' demographics and users_secure password hashes.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.