CVE-2026-124468OpenEMR before 8.3.0 SQL Injection via Patient Insurance and Employer REST API

Descripción

OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Standard REST API patient insurance and employer search, which concatenates query-string parameter names into SQL as column identifiers without escaping. Authenticated clients, including low-privilege patient-portal OAuth2 tokens, can send crafted parameter names to /api/patient/{puuid}/insurance or /api/patient/{puuid}/employer to extract patient PHI, user records, and API client secrets.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• GitHub Security Advisory (GHSA-fhc4-8f9p-8mcc) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: OpenEMR before 8.3.0 SQL Injection via Patient Insurance and Employer REST API third-party-advisory