CVE-2026-126455: OpenEMR before 8.5.0 Privilege Escalation via Missing Authorization and SQL Injection
OpenEMR before 8.5.0 contains multiple missing authorization and SQL injection defects across report, portal, transaction, and immunization components. Low-privileged Front Office clerks can chain these to read arbitrary database tables including userssecure hashes, hijack patient portal identities, and forge approved clinical records.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit these flaws?
A low-privileged Front Office clerk account can chain the affected defects. Exploitation does not require user interaction.
What can an attacker achieve after exploiting the issue?
An attacker can read arbitrary database tables, including users_secure password hashes, hijack patient portal identities, and forge approved clinical records. The reported impact includes high confidentiality and integrity impact, with no availability impact.
Are deployments running version 8.5.0 affected?
The issue is reported in OpenEMR versions before 8.5.0. Deployments on 8.5.0 are not described as affected by this advisory.