CVE-2026-126434OpenEMR before 8.5.0 Missing Authorization in Procedure Order Form

Açıklama

OpenEMR before 8.5.0 contains a missing authorization vulnerability in interface/forms/procedure_order/common.php that allows authenticated accounts lacking patients/lab permission to read and modify other patients' procedure orders. Attackers can request a global order id to disclose clinical history, or select the target patient in their session and submit bn_save to falsify diagnoses, instructions, and order status.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-q5c6-96vf-rx9v) vendor-advisory
• VulnCheck Advisory: OpenEMR before 8.5.0 Missing Authorization in Procedure Order Form third-party-advisory