CVE-2026-126467: OpenEMR before 8.5.0 Mass Assignment via Observation Form save.php
OpenEMR before 8.5.0 contains a mass assignment vulnerability in ObservationController::processEnhancedFormSave() that allows authenticated low-privilege users to forge authorization flags through an incomplete field blacklist. Attackers can submit authorized=1 or override the id field alongside observationid to mark observations as Provider-signed and overwrite clinical fields of other observations within the same patient encounter.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated low-privilege OpenEMR user can exploit it. The attack is network-reachable and does not require user interaction.
What access or target scope does an attacker need?
The attacker needs an authenticated account and must target observations within the same patient encounter. They can submit authorized=1 to mark an observation as Provider-signed or override the id field with observation_id to overwrite clinical fields.
Which versions require remediation?
OpenEMR versions before 8.5.0 are affected. Upgrading to 8.5.0 or later addresses the affected version range described.
How can administrators identify possible exploitation?
Review observation records for unexpected Provider-signed status and for clinical-field changes inconsistent with the expected author or workflow. Pay particular attention to records where authorization flags or observation identifiers may have been submitted through the observation form save path.