CVE-2026-126446: OpenEMR before 8.5.0 Missing Authorization via destroyed_drugs_report.php
OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to retrieve destroyed-drug records because destroyeddrugsreport.php lacks the admin/drugs or inventory/reporting ACL check. Attackers can submit the report refresh form with a chosen date range to obtain drug names, NDC, lots, quantities, destruction methods, witnesses, and notes.
Affected Software
Event History
Frequently Asked Questions
Which users can access the destroyed-drug records?
Any authenticated OpenEMR core user can retrieve the records, including users who do not have the admin/drugs or inventory/reporting ACL permission.
What does an attacker need to do to obtain the data?
The attacker needs a valid authenticated core-user account and can submit the destroyed-drug report refresh form with a selected date range. No user interaction is required.
What information could be exposed?
The report can disclose drug names, NDC values, lot numbers, quantities, destruction methods, witness information, and notes.
Which deployments are affected?
OpenEMR versions before 8.5.0 are affected. The issue is specifically caused by the missing authorization checks in destroyed_drugs_report.php.