CVE-2026-126322: OpenEMR before 8.3.0 Unsanitized Deserialization via patient_match_dialog.php
OpenEMR before 8.3.0 contains an unsanitized deserialization vulnerability that allows authenticated attackers to control patient-matching criteria by supplying a crafted serialized key parameter. Attackers can send serialized arrays to interface/orders/patientmatchdialog.php to enumerate patients or force matches that associate lab orders with the wrong patient.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to OpenEMR and able to submit requests to interface/orders/patient_match_dialog.php. No user interaction is required.
What can an attacker do with successful exploitation?
An attacker can supply crafted serialized key parameters to control patient-matching criteria. This can enable patient enumeration or force a match that associates a lab order with the wrong patient.
Which versions are affected?
OpenEMR versions before 8.3.0 are affected. The provided data does not identify a narrower affected version range or configuration prerequisite.