CVE-2026-126416OpenEMR before 8.5.0 Improper Authorization via patient_tracker_status.php

Beschreibung

OpenEMR before 8.5.0 contains an improper authorization vulnerability in patient_tracker_status.php that allows low-privilege authenticated users to modify other patients' tracker entries by supplying arbitrary tracker_id values. Attackers can post statustype and roomnum parameters with a valid CSRF token to alter patient-flow status, room assignments, and linked calendar appointment state.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-cxjf-fmpw-qc34) vendor-advisory
• VulnCheck Advisory: OpenEMR before 8.5.0 Improper Authorization via patient_tracker_status.php third-party-advisory