CVE-2026-126433: OpenEMR before 8.5.0 Improper Authorization via dispense_drug.php
OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/drugs/dispensedrug.php, which checks only for admin/drugs view permission instead of write permission before dispensing medication. Authenticated users with read-only drug administration access can send GET requests with drugid, quantity, fee, and encounter parameters to create false dispensing records and decrement inventory.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated user who has read-only access to drug administration through the admin/drugs view permission may be able to exploit it. Write permission is not required by the affected endpoint.
What does an attacker need to do to exploit it?
The attacker must be authenticated and able to send a GET request to dispense_drug.php containing drug_id, quantity, fee, and encounter parameters. Exploitation does not require user interaction.
What is the impact if exploitation succeeds?
An attacker can create false medication dispensing records and reduce the associated drug inventory. The supplied severity vector indicates integrity impact and a limited availability impact, with no stated confidentiality impact.
How can I determine whether my deployment is affected?
Deployments running OpenEMR versions before 8.5.0 are affected according to the available information. Review whether users assigned only admin/drugs view access can reach interface/drugs/dispense_drug.php and whether dispensing records or inventory reductions were created unexpectedly.