{"id":"CVE-2026-126493","kind":"vulnerability","aliases":["CVE-2026-126493"],"related":[],"title":"OpenEMR: stored XSS in patient portal activity API lets scripts run","description":"OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows low-privileged patient portal users to inject JavaScript via the tableArgs field of the onsiteportalactivity API. Attackers can store a payload with spaces that breaks out of an unquoted data-delete-id attribute, executing script when providers click the delete button on the audit review page.","summary":"OpenEMR before 8.5.0 accepts a crafted tableArgs value in the onsiteportalactivity API that is stored and later rendered unescaped on the audit review page. A low-privileged patient portal user can inject JavaScript that runs in a provider's browser when they click the delete button.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","runtime","self-hosted"],"not_affected_if":["openemr-8.5.0-or-later","patient-portal-disabled"],"how_to_check":"- Check the installed OpenEMR version against the fixed version in the vendor advisory.\n- Confirm whether the patient portal is enabled and whether patients have portal accounts.","fix":"- Upgrade OpenEMR to `8.5.0` or later.","status":"open","published_at":"2026-11-13T10:17:59+00:00","first_seen_at":"2026-11-13T10:47:27+00:00","triaged_at":"2026-11-13T10:56:51+00:00","updated_at":"2026-11-13T10:56:51+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-13T10:56:51Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenEMR to `8.5.0` or later.","reach":"network","title":"OpenEMR: stored XSS in patient portal activity API lets scripts run","impact":"medium","summary":"OpenEMR before 8.5.0 accepts a crafted tableArgs value in the onsiteportalactivity API that is stored and later rendered unescaped on the audit review page. A low-privileged patient portal user can inject JavaScript that runs in a provider's browser when they click the delete button.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","healthcare","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"script runs in provider sessions, enabling session hijacking or data theft","analyst_note":"","how_to_check":"- Check the installed OpenEMR version against the fixed version in the vendor advisory.\n- Confirm whether the patient portal is enabled and whether patients have portal accounts.\n- Unknown whether a specific configuration or setting is required.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patient-portal-disabled","openemr-8.5.0-or-later"],"who_is_affected":"OpenEMR installations before 8.5.0 with the patient portal enabled are exposed, because low-privileged patient portal users can store the payload. Providers who review the audit page in the admin interface are the victims. Installations without the patient portal, or already on 8.5.0 or later, are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000744,"input_tokens":4624,"output_tokens":564,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126493':14A,17A '-2026':13A,16A '8.5.0':26B,73C 'accept':27B 'activ':7A 'allow':83C 'api':8A,35B,100C 'attack':101C 'attribut':118C 'audit':45B,129C 'break':109C 'browser':64B 'button':70B,126C 'click':67B,123C 'contain':74C 'craft':29B 'cross':78C 'cross-sit':77C 'cve':12A,15A 'data':115C 'data-delete-id':114C 'delet':69B,116C,125C 'execut':119C 'field':96C 'healthcar':18B 'host':23B 'id':117C 'inject':56B,91C 'javascript':57B,92C 'later':40B 'let':9A 'low':50B,85C 'low-privileg':49B,84C 'onsiteportalact':34B,99C 'openemr':1A,19B,24B,71C 'page':47B,131C 'patient':5A,52B,87C 'payload':105C 'portal':6A,53B,88C 'privileg':51B,86C 'provid':62B,122C 'render':41B 'review':46B,130C 'run':11A,59B 'runtim':20B 'script':10A,80C,120C 'self':22B 'self-host':21B 'site':79C 'space':107C 'store':2A,38B,76C,103C 'tablearg':30B,95C 'unescap':42B 'unquot':113C 'user':54B,89C 'valu':31B 'via':93C 'vulner':81C 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"OpenEMR installations before 8.5.0 with the patient portal enabled are exposed, because low-privileged patient portal users can store the payload. Providers who review the audit page in the admin interface are the victims. Installations without the patient portal, or already on 8.5.0 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","medium","openemr","runtime","selfhosted"],"campaign_type":null,"search_a":"'-126493':14A,17A '-2026':13A,16A 'activ':7A 'api':8A 'cve':12A,15A 'let':9A 'openemr':1A 'patient':5A 'portal':6A 'run':11A 'script':10A 'store':2A 'xss':3A","search_b":"'8.5.0':26B 'accept':27B 'api':35B 'audit':45B 'browser':64B 'button':70B 'click':67B 'craft':29B 'delet':69B 'healthcar':18B 'host':23B 'inject':56B 'javascript':57B 'later':40B 'low':50B 'low-privileg':49B 'onsiteportalact':34B 'openemr':19B,24B 'page':47B 'patient':52B 'portal':53B 'privileg':51B 'provid':62B 'render':41B 'review':46B 'run':59B 'runtim':20B 'self':22B 'self-host':21B 'store':38B 'tablearg':30B 'unescap':42B 'user':54B 'valu':31B","search_c":"'8.5.0':73C 'allow':83C 'api':100C 'attack':101C 'attribut':118C 'audit':129C 'break':109C 'button':126C 'click':123C 'contain':74C 'cross':78C 'cross-sit':77C 'data':115C 'data-delete-id':114C 'delet':116C,125C 'execut':119C 'field':96C 'id':117C 'inject':91C 'javascript':92C 'low':85C 'low-privileg':84C 'onsiteportalact':99C 'openemr':71C 'page':131C 'patient':87C 'payload':105C 'portal':88C 'privileg':86C 'provid':122C 'review':130C 'script':80C,120C 'site':79C 'space':107C 'store':76C,103C 'tablearg':95C 'unquot':113C 'user':89C 'via':93C 'vulner':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:23:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126493","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126493","severity":null,"published_at":"2026-11-13T10:17:59+00:00","modified_at":"2026-11-13T10:18:00+00:00","first_seen_at":"2026-11-13T10:47:27+00:00","fetched_at":"2026-11-13T10:47:27+00:00","note":null}],"documents":[{"id":145229,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-r4hm-frcj-qr39","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:23:55+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145230,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-onsiteportalactivity-tableargs","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}