CVE-2026-126415: OpenEMR before 8.5.0 Missing Authorization via Patientvalidation Module
OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Patient Validation module that allows any authenticated user to retrieve patient demographic records. Attackers can send direct requests with wildcard mflname or empty mf parameters to the patientvalidation endpoint to enumerate the entire patientdata table.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated OpenEMR user can exploit it. The attacker does not need additional privileges beyond a valid account.
What access can an attacker obtain?
An attacker can retrieve patient demographic records and enumerate the entire patient_data table. The disclosed impact is confidentiality loss; integrity and availability impacts are not indicated.
What request characteristics trigger the exposure?
The issue can be triggered by sending direct requests to the patientvalidation endpoint using a wildcard mf_lname parameter or empty mf_ parameters.
Which deployments are affected?
OpenEMR versions before 8.5.0 are affected. The provided information does not state that any particular configuration change is required for exploitation.