CVE-2026-126416OpenEMR before 8.5.0 Improper Authorization via patient_tracker_status.php

Açıklama

OpenEMR before 8.5.0 contains an improper authorization vulnerability in patient_tracker_status.php that allows low-privilege authenticated users to modify other patients' tracker entries by supplying arbitrary tracker_id values. Attackers can post statustype and roomnum parameters with a valid CSRF token to alter patient-flow status, room assignments, and linked calendar appointment state.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-cxjf-fmpw-qc34) vendor-advisory
• VulnCheck Advisory: OpenEMR before 8.5.0 Improper Authorization via patient_tracker_status.php third-party-advisory