CVE-2026-126432OpenEMR before 8.5.0 Improper Authorization in Lab Order Transmission via list_reports.php

Beschreibung

OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/list_reports.php that allows read-only users to transmit lab orders because the patients/med check ignores write permission. Authenticated attackers can submit form_xmit with arbitrary procedure order IDs to send HL7 orders containing SSNs, insurance, and diagnoses to laboratories and mark them transmitted.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-3xjm-656g-cfj5) vendor-advisory
• VulnCheck Advisory: OpenEMR before 8.5.0 Improper Authorization in Lab Order Transmission via list_reports.php third-party-advisory