{"id":"CVE-2026-126492","kind":"vulnerability","aliases":["CVE-2026-126492"],"related":[],"title":"OpenEMR: stored SQL injection lets low-privilege users read patient data","description":"OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows low-privileged authenticated users to store malicious SQL via library/ajax/addlistitem.php. Attackers can persist a SQL fragment in the recent_patient_columns option_id value, which dynamic_finder.php concatenates into a SELECT query and executes as SQL.","summary":"OpenEMR, an electronic health records system, stores attacker-supplied SQL in a list-item option that a later query concatenates and runs. An authenticated low-privileged user can use this to run SQL against the database.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","other","php","self-hosted"],"not_affected_if":["no-low-privilege-accounts","openemr-8.5.0-or-later"],"how_to_check":"- Check the installed OpenEMR version in the application's version page or `version.php`; versions below `8.5.0` are named in the description as affected.\n- Review whether untrusted users have accounts that can call `library/ajax/addlistitem.php`.","fix":"- OpenEMR: move to `8.5.0` or later (fixed version named in the description).","status":"open","published_at":"2026-11-13T10:17:59+00:00","first_seen_at":"2026-11-13T10:47:26+00:00","triaged_at":"2026-11-13T10:52:55+00:00","updated_at":"2026-11-13T10:52:55+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T10:52:55Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.5.0` or later (fixed version named in the description).","reach":"network","title":"OpenEMR: stored SQL injection lets low-privilege users read patient data","impact":"high","summary":"OpenEMR, an electronic health records system, stores attacker-supplied SQL in a list-item option that a later query concatenates and runs. An authenticated low-privileged user can use this to run SQL against the database.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"database contents readable and altered by low-privileged accounts","analyst_note":"Confirm the exact affected range and whether a default install exposes addlistitem.php to all logged-in users; check the vendor advisory on github.com and the VulnCheck page.","how_to_check":"- Check the installed OpenEMR version in the application's version page or `version.php`; versions below `8.5.0` are named in the description as affected.\n- Review whether untrusted users have accounts that can call `library/ajax/addlistitem.php`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["openemr-8.5.0-or-later","no-low-privilege-accounts"],"who_is_affected":"OpenEMR installations before 8.5.0 where authenticated users can add list items. The flaw is second-order: the payload is stored through addlistitem.php and executed later when dynamic_finder.php builds a SELECT query. Teams that run OpenEMR for clinics or hospitals should treat it as a patient-data exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000764,"input_tokens":4619,"output_tokens":605,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126492':15A,18A '-2026':14A,17A '8.5.0':67C 'allow':77C 'attack':34B,89C 'attacker-suppli':33B 'authent':51B,81C 'column':99C 'concaten':47B,105C 'contain':68C 'cve':13A,16A 'data':12A 'databas':64B 'dynamic_finder.php':104C 'electron':28B 'execut':111C 'fragment':94C 'health':29B 'healthcar':19B 'host':25B 'id':101C 'inject':4A,74C 'item':41B 'later':45B 'let':5A 'library/ajax/addlistitem.php':88C 'list':40B 'list-item':39B 'low':7A,53B,79C 'low-privileg':6A,52B,78C 'malici':85C 'openemr':1A,20B,26B,65C 'option':42B,100C 'order':72C 'patient':11A,98C 'persist':91C 'php':22B 'privileg':8A,54B,80C 'queri':46B,109C 'read':10A 'recent':97C 'record':30B 'run':49B,60B 'second':71C 'second-ord':70C 'select':108C 'self':24B 'self-host':23B 'sql':3A,36B,61B,73C,86C,93C,113C 'store':2A,32B,84C 'suppli':35B 'system':31B 'use':57B 'user':9A,55B,82C 'valu':102C 'via':87C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"OpenEMR installations before 8.5.0 where authenticated users can add list items. The flaw is second-order: the payload is stored through addlistitem.php and executed later when dynamic_finder.php builds a SELECT query. Teams that run OpenEMR for clinics or hospitals should treat it as a patient-data exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","other","php","selfhosted"],"campaign_type":null,"search_a":"'-126492':15A,18A '-2026':14A,17A 'cve':13A,16A 'data':12A 'inject':4A 'let':5A 'low':7A 'low-privileg':6A 'openemr':1A 'patient':11A 'privileg':8A 'read':10A 'sql':3A 'store':2A 'user':9A","search_b":"'attack':34B 'attacker-suppli':33B 'authent':51B 'concaten':47B 'databas':64B 'electron':28B 'health':29B 'healthcar':19B 'host':25B 'item':41B 'later':45B 'list':40B 'list-item':39B 'low':53B 'low-privileg':52B 'openemr':20B,26B 'option':42B 'php':22B 'privileg':54B 'queri':46B 'record':30B 'run':49B,60B 'self':24B 'self-host':23B 'sql':36B,61B 'store':32B 'suppli':35B 'system':31B 'use':57B 'user':55B","search_c":"'8.5.0':67C 'allow':77C 'attack':89C 'authent':81C 'column':99C 'concaten':105C 'contain':68C 'dynamic_finder.php':104C 'execut':111C 'fragment':94C 'id':101C 'inject':74C 'library/ajax/addlistitem.php':88C 'low':79C 'low-privileg':78C 'malici':85C 'openemr':65C 'option':100C 'order':72C 'patient':98C 'persist':91C 'privileg':80C 'queri':109C 'recent':97C 'second':71C 'second-ord':70C 'select':108C 'sql':73C,86C,93C,113C 'store':84C 'user':82C 'valu':102C 'via':87C 'vulner':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:43:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126492","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126492","severity":null,"published_at":"2026-11-13T10:17:59+00:00","modified_at":"2026-11-13T10:17:59+00:00","first_seen_at":"2026-11-13T10:47:26+00:00","fetched_at":"2026-11-13T10:47:26+00:00","note":null}],"documents":[{"id":145227,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-hrf6-qx6w-vgh9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:43:57+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145228,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-second-order-sql-injection-via-dynamic-finder-php","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}