CVE-2026-126470: OpenEMR before 8.5.0 IDOR in Carecoordination CCDA/CCR/QRDA Document Actions
OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the Carecoordination module that allows authenticated users with sendtohie permission to access any patient's CCDA/CCR/QRDA documents. Attackers can supply arbitrary document or patient IDs to download, transmit, or export patient health records, inject falsified clinical data, and delete audit records.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker must be authenticated and have the send_to_hie permission in the Carecoordination module. No user interaction is required.
What actions can an authorized attacker perform?
They can use arbitrary document or patient IDs to download, transmit, or export CCDA, CCR, and QRDA patient records. They can also inject falsified clinical data and delete audit records.
Which deployments are affected?
OpenEMR versions before 8.5.0 are affected where users have the send_to_hie permission. The available information does not state whether that permission is assigned by default.
How can administrators identify potential exposure?
Review whether the OpenEMR deployment is running a version before 8.5.0 and identify accounts assigned the send_to_hie permission. Audit Carecoordination document actions for access, transmission, export, data injection, or audit-record deletion involving unexpected patient or document IDs.