CVE-2026-126422: OpenEMR before 8.5.0 Missing Authorization via lists_touch.php
OpenEMR before 8.5.0 contains a missing authorization vulnerability in library/ajax/liststouch.php that allows restricted authenticated users to mark another patient's clinical lists as reviewed. Attackers can submit arbitrary patientid and type values to falsely record "None known" allergy, medication, or problem lists, misleading clinicians and skewing quality-measure calculations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMRto a version that resolves this vulnerability.Fixed in 8.5.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated OpenEMR user with restricted privileges can exploit it. The attacker needs the ability to submit requests to library/ajax/lists_touch.php.
What access or input does an attacker need?
The attacker must be able to provide arbitrary patient_id and type values. No user interaction is required.
What is the practical impact of successful exploitation?
An attacker can mark another patient's allergy, medication, or problem list as reviewed with a "None known" status. This can mislead clinicians and skew quality-measure calculations.
Which versions are affected?
OpenEMR versions before 8.5.0 are affected.