CVE-2026-126435: OpenEMR before 8.5.0 Improper Authorization via order_manifest.php Lab-Order Flags
OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/ordermanifest.php, which checks patients/med without requiring write access or applying patient squad restrictions. Users with only patients/med view permission can request any order ID to read squad-restricted patient data and submit bnsave and formomit parameters, without a CSRF token, to set donotsend flags that suppress ordered lab procedures.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.5.0
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker needs an authenticated account with patients/med view permission. Write access is not required, and patient squad restrictions are not enforced by the affected endpoint.
What can an attacker do through the affected endpoint?
They can request arbitrary order IDs to read data for squad-restricted patients. They can also submit the bn_save and form_omit parameters without a CSRF token to set do_not_send flags, suppressing ordered lab procedures.