CVE-2026-126443: OpenEMR before 8.5.0 Missing Authorization via dynamic_finder_ajax.php Patient Finder

Q: Who can exploit this issue?

An authenticated OpenEMR user can exploit it even if they do not have the patients/demo permission. The attacker needs network access to the affected OpenEMR instance and valid credentials with low-privilege access.

Q: What information could be exposed?

An attacker can use the sColumns parameter to request arbitrary patient_data columns and enumerate patient demographics across the practice. Exposed data can include names, dates of birth, contact details, and Social Security numbers.

Q: Which versions are affected?

OpenEMR versions before 8.5.0 are affected. The provided information does not identify any other affected configuration conditions.

Published Nov 13, 2026

Updated

OpenEMR before 8.5.0 contains a missing authorization vulnerability in dynamicfinderajax.php that allows authenticated users without patients/demo permission to query patient demographics. Attackers can supply arbitrary patientdata columns via the sColumns parameter to enumerate names, dates of birth, contact details, and Social Security numbers across the practice.

Affected Software

1 affected component

OpenEMR OpenEMR<8.5.0

Event History

Nov 13, 2026

CVE Published

via MITRE·09:35 AM

Data Sourced

via MITRE·09:35 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated OpenEMR user can exploit it even if they do not have the patients/demo permission. The attacker needs network access to the affected OpenEMR instance and valid credentials with low-privilege access.

What information could be exposed?

An attacker can use the sColumns parameter to request arbitrary patient_data columns and enumerate patient demographics across the practice. Exposed data can include names, dates of birth, contact details, and Social Security numbers.

Which versions are affected?

OpenEMR versions before 8.5.0 are affected. The provided information does not identify any other affected configuration conditions.

CVE-2026-126443: OpenEMR before 8.5.0 Missing Authorization via dynamic_finder_ajax.php Patient Finder

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Which versions are affected?