CVE-2026-126416OpenEMR before 8.5.0 Improper Authorization via patient_tracker_status.php

Descripción

OpenEMR before 8.5.0 contains an improper authorization vulnerability in patient_tracker_status.php that allows low-privilege authenticated users to modify other patients' tracker entries by supplying arbitrary tracker_id values. Attackers can post statustype and roomnum parameters with a valid CSRF token to alter patient-flow status, room assignments, and linked calendar appointment state.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• GitHub Security Advisory (GHSA-cxjf-fmpw-qc34) vendor-advisory
• VulnCheck Advisory: OpenEMR before 8.5.0 Improper Authorization via patient_tracker_status.php third-party-advisory