CVE-2026-126438: OpenEMR before 8.5.0 Improper Authorization in Clinical-Rule Editor patient_data.php
OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/patientfile/rules/patientdata.php that allows read-only patients/med users to modify clinical-rule records. Attackers can submit a global formentryID row ID to overwrite completion date, state, and result, including records of patients outside their configured squad.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.5.0
Event History
Frequently Asked Questions
Which users can exploit this issue?
A user with a read-only patient or medication-user role can exploit it. No user interaction is required.
What access is needed to alter another patient's clinical-rule record?
The attacker needs a global form_entryID row ID. Using that ID, they can overwrite the completion date, state, and result for records belonging to patients outside their configured squad.
Which versions are affected?
OpenEMR versions before 8.5.0 are affected.