CVE-2026-126432: OpenEMR before 8.5.0 Improper Authorization in Lab Order Transmission via list_reports.php
OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/listreports.php that allows read-only users to transmit lab orders because the patients/med check ignores write permission. Authenticated attackers can submit formxmit with arbitrary procedure order IDs to send HL7 orders containing SSNs, insurance, and diagnoses to laboratories and mark them transmitted.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated OpenEMR user with read-only access can exploit it. The attack requires the user to submit the form_xmit parameter with procedure order IDs.
What information may be exposed or altered through exploitation?
The attacker can cause HL7 lab orders containing Social Security numbers, insurance information, and diagnoses to be sent to laboratories. The affected orders can also be marked as transmitted.
Are installations before version 8.5.0 affected?
The issue affects OpenEMR versions before 8.5.0. The provided information does not identify configuration conditions that would exclude an affected version.