CVE-2026-126445: OpenEMR before 8.5.0 Missing Authorization in Patient Flow Board Tracker Endpoints
OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to modify arbitrary Patient Flow Board trackers without the patients/appt permission. Attackers can submit a victim trackerid to patienttrackerstatus.php or drugscreencompleted.php to falsify check-in status, rooms, drug-screen completion, and tracker history.
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated OpenEMR core user can exploit it, including users that do not have the patients/appt permission.
What access and information does an attacker need?
The attacker needs an authenticated core-user account and a victim tracker_id. They can submit that ID to patient_tracker_status.php or drug_screen_completed.php.
What records or workflow data can be altered?
An attacker can falsify Patient Flow Board check-in status, assigned rooms, drug-screen completion, and tracker history for arbitrary trackers.
Which versions are affected?
OpenEMR versions before 8.5.0 are affected.