CVE-2026-126415OpenEMR before 8.5.0 Missing Authorization via Patientvalidation Module

Açıklama

OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Patient Validation module that allows any authenticated user to retrieve patient demographic records. Attackers can send direct requests with wildcard mf_lname or empty mf_ parameters to the patientvalidation endpoint to enumerate the entire patient_data table.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-q4jf-6gcg-m3jx) vendor-advisory
• VulnCheck Advisory: OpenEMR before 8.5.0 Missing Authorization via Patientvalidation Module third-party-advisory