CVE-2026-126465: OpenEMR before 8.5.0 SQL Injection via OnsiteActivityView _BitwiseAnd Criteria
OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal api/onsiteactivityviews endpoint that allows any authenticated staff user to inject SQL through unquoted IdBitwiseAnd Criteria values. Attackers can close the bitwise parenthesis and append OR or UNION SELECT clauses to read patient PHI, staff password hashes, MySQL authentication strings, and API tokens.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated OpenEMR staff-user account. The vulnerable endpoint is in the patient portal API, but the described prerequisite is staff authentication rather than unauthenticated access.
What information could be exposed?
Successful SQL injection can be used to read patient protected health information, staff password hashes, MySQL authentication strings, and API tokens. The provided severity vector indicates high confidentiality impact, with no stated integrity or availability impact.
Which deployments are affected?
OpenEMR versions before 8.5.0 are affected. The issue is triggered through unquoted Id_BitwiseAnd Criteria values supplied to the api/onsiteactivityviews endpoint.