CVE-2026-126434: OpenEMR before 8.5.0 Missing Authorization in Procedure Order Form
Published Nov 13, 2026
·Updated
OpenEMR before 8.5.0 contains a missing authorization vulnerability in interface/forms/procedureorder/common.php that allows authenticated accounts lacking patients/lab permission to read and modify other patients' procedure orders. Attackers can request a global order id to disclose clinical history, or select the target patient in their session and submit bnsave to falsify diagnoses, instructions, and order status.
Affected Software
1 affected component
OpenEMR OpenEMR<8.5.0
Event History
Nov 13, 2026
CVE Published
via MITRE·09:35 AM
Data Sourced
via MITRE·09:35 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What version should be deployed to remediate this issue?
Upgrade OpenEMR to version 8.5.0 or later. Versions before 8.5.0 are affected.