CVE-2026-126416: OpenEMR before 8.5.0 Improper Authorization via patient_tracker_status.php
OpenEMR before 8.5.0 contains an improper authorization vulnerability in patienttrackerstatus.php that allows low-privilege authenticated users to modify other patients' tracker entries by supplying arbitrary trackerid values. Attackers can post statustype and roomnum parameters with a valid CSRF token to alter patient-flow status, room assignments, and linked calendar appointment state.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
An attacker needs a low-privilege authenticated OpenEMR account and a valid CSRF token. No user interaction is required.
What can be changed through exploitation?
An attacker can supply arbitrary tracker_id values to modify other patients' tracker entries. The affected fields include patient-flow status, room assignments, and linked calendar appointment state.
Which versions should be considered affected?
OpenEMR versions before 8.5.0 are affected. Upgrading to 8.5.0 or later addresses the stated affected version range.