{"id":"CVE-2026-126488","kind":"vulnerability","aliases":["CVE-2026-126488"],"related":[],"title":"OpenEMR: patient portal SQL injection exposes whole database to patients","description":"OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal OnsiteDocument.Query endpoint, where mass-assigned _BitwiseAnd criteria parameters are placed unquoted into SQL with only quote-character escaping. Authenticated portal patients can inject SQL outside their per-patient scope to read the entire database, including other patients' demographics and users_secure password hashes.","summary":"OpenEMR before 8.5.0 has an SQL injection flaw in the patient portal OnsiteDocument.Query endpoint, where the _BitwiseAnd parameters go into SQL unquoted. An authenticated patient can read the whole database, including other patients' records and staff password hashes.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","other","patient-portal","self-hosted"],"not_affected_if":["portal-disabled","version-8.5.0-or-later"],"how_to_check":"- Check the installed OpenEMR version against the fixed release, `8.5.0`\n- Confirm whether the patient portal is enabled on the deployment","fix":"- OpenEMR: upgrade to `8.5.0` or later","status":"open","published_at":"2026-11-13T10:17:59+00:00","first_seen_at":"2026-11-13T10:47:26+00:00","triaged_at":"2026-11-13T10:51:08+00:00","updated_at":"2026-11-13T10:51:08+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T10:51:08Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: upgrade to `8.5.0` or later","reach":"internet","title":"OpenEMR: patient portal SQL injection exposes whole database to patients","impact":"high","summary":"OpenEMR before 8.5.0 has an SQL injection flaw in the patient portal OnsiteDocument.Query endpoint, where the _BitwiseAnd parameters go into SQL unquoted. An authenticated patient can read the whole database, including other patients' records and staff password hashes.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","patient-portal"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads entire database, including patient records and password hashes","analyst_note":"","how_to_check":"- Check the installed OpenEMR version against the fixed release, `8.5.0`\n- Confirm whether the patient portal is enabled on the deployment","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-8.5.0-or-later","portal-disabled"],"who_is_affected":"Any OpenEMR deployment before 8.5.0 with the patient portal enabled is exposed, because the flaw is reached through a portal patient account. Deployments without the patient portal, or on 8.5.0 or later, are not affected. The sources do not say whether the portal is on by default.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000728,"input_tokens":4645,"output_tokens":527,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126488':13A,16A '-2026':12A,15A '8.5.0':28B,66C 'assign':81C 'authent':49B,96C 'bitwiseand':42B,82C 'charact':94C 'contain':67C 'criteria':83C 'cve':11A,14A 'databas':8A,55B,112C 'demograph':116C 'endpoint':39B,77C 'entir':111C 'escap':95C 'expos':6A 'flaw':33B 'go':44B 'hash':63B,121C 'healthcar':17B 'host':25B 'includ':56B,113C 'inject':5A,32B,70C,100C 'mass':80C 'mass-assign':79C 'onsitedocument.query':38B,76C 'openemr':1A,18B,26B,64C 'outsid':102C 'paramet':43B,84C 'password':62B,120C 'patient':2A,10A,21B,36B,50B,58B,74C,98C,106C,115C 'patient-port':20B 'per':105C 'per-pati':104C 'place':86C 'portal':3A,22B,37B,75C,97C 'quot':93C 'quote-charact':92C 'read':52B,109C 'record':59B 'scope':107C 'secur':119C 'self':24B 'self-host':23B 'sql':4A,31B,46B,69C,89C,101C 'staff':61B 'unquot':47B,87C 'user':118C 'vulner':71C 'whole':7A,54B","nicknames":[],"mitigations":[],"who_affected":"Any OpenEMR deployment before 8.5.0 with the patient portal enabled is exposed, because the flaw is reached through a portal patient account. Deployments without the patient portal, or on 8.5.0 or later, are not affected. The sources do not say whether the portal is on by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","other","patientportal","selfhosted"],"campaign_type":null,"search_a":"'-126488':13A,16A '-2026':12A,15A 'cve':11A,14A 'databas':8A 'expos':6A 'inject':5A 'openemr':1A 'patient':2A,10A 'portal':3A 'sql':4A 'whole':7A","search_b":"'8.5.0':28B 'authent':49B 'bitwiseand':42B 'databas':55B 'endpoint':39B 'flaw':33B 'go':44B 'hash':63B 'healthcar':17B 'host':25B 'includ':56B 'inject':32B 'onsitedocument.query':38B 'openemr':18B,26B 'paramet':43B 'password':62B 'patient':21B,36B,50B,58B 'patient-port':20B 'portal':22B,37B 'read':52B 'record':59B 'self':24B 'self-host':23B 'sql':31B,46B 'staff':61B 'unquot':47B 'whole':54B","search_c":"'8.5.0':66C 'assign':81C 'authent':96C 'bitwiseand':82C 'charact':94C 'contain':67C 'criteria':83C 'databas':112C 'demograph':116C 'endpoint':77C 'entir':111C 'escap':95C 'hash':121C 'includ':113C 'inject':70C,100C 'mass':80C 'mass-assign':79C 'onsitedocument.query':76C 'openemr':64C 'outsid':102C 'paramet':84C 'password':120C 'patient':74C,98C,106C,115C 'per':105C 'per-pati':104C 'place':86C 'portal':75C,97C 'quot':93C 'quote-charact':92C 'read':109C 'scope':107C 'secur':119C 'sql':69C,89C,101C 'unquot':87C 'user':118C 'vulner':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:28:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126488","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126488","severity":null,"published_at":"2026-11-13T10:17:59+00:00","modified_at":"2026-11-13T10:17:59+00:00","first_seen_at":"2026-11-13T10:47:26+00:00","fetched_at":"2026-11-13T10:47:26+00:00","note":null}],"documents":[{"id":145219,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-g2xw-rvhq-x543","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:28:37+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145220,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-onsitedocument-query-bitwiseand","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}