CVE-2026-126434OpenEMR before 8.5.0 Missing Authorization in Procedure Order Form

Beschreibung

OpenEMR before 8.5.0 contains a missing authorization vulnerability in interface/forms/procedure_order/common.php that allows authenticated accounts lacking patients/lab permission to read and modify other patients' procedure orders. Attackers can request a global order id to disclose clinical history, or select the target patient in their session and submit bn_save to falsify diagnoses, instructions, and order status.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-q5c6-96vf-rx9v) vendor-advisory
• VulnCheck Advisory: OpenEMR before 8.5.0 Missing Authorization in Procedure Order Form third-party-advisory