CVE-2026-126434OpenEMR before 8.5.0 Missing Authorization in Procedure Order Form

Descripción

OpenEMR before 8.5.0 contains a missing authorization vulnerability in interface/forms/procedure_order/common.php that allows authenticated accounts lacking patients/lab permission to read and modify other patients' procedure orders. Attackers can request a global order id to disclose clinical history, or select the target patient in their session and submit bn_save to falsify diagnoses, instructions, and order status.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• GitHub Security Advisory (GHSA-q5c6-96vf-rx9v) vendor-advisory
• VulnCheck Advisory: OpenEMR before 8.5.0 Missing Authorization in Procedure Order Form third-party-advisory