CVE-2026-126452: OpenEMR before 8.5.0 Missing Authorization via diagnosis_full.php Billing Operations
OpenEMR before 8.5.0 contains a missing authorization vulnerability in diagnosisfull.php that allows authenticated users to delete or clear any billing record by ID. Attackers can supply a target billing ID in the id parameter with delete or clear mode to deactivate other patients' charges and corrupt financial records.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated OpenEMR user may be able to exploit it, because exploitation requires only low-level privileges and no user interaction.
What access and input are required to affect another patient's billing record?
An attacker needs an authenticated session and a target billing record ID. They can provide that ID through the id parameter while using delete or clear mode.
Are default deployments affected?
The provided information identifies affected versions as OpenEMR before 8.5.0, but does not state whether a particular default configuration or role setup prevents exploitation.
How can an organization identify possible exploitation?
Review billing records for charges that were unexpectedly deleted, cleared, or deactivated. The available information does not provide specific log entries, request patterns, or indicators of compromise.