CVE-2026-126471: OpenEMR before 8.5.0 Missing Authorization via print_referral.php and trend_form.php
OpenEMR before 8.5.0 contains a missing authorization vulnerability in printreferral.php and trendform.php that allows low-privileged Front Office users to access patient PHI without patients:med permission. Attackers can directly request these endpoints with arbitrary patientid values to retrieve patient demographics, insurance data, and vitals history, enumerating IDs to expand disclosure.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
A low-privileged Front Office user can exploit it. The affected endpoints do not require the patients:med permission that should restrict access to the disclosed patient information.
What does an attacker need to do to access patient data?
The attacker needs an authenticated Front Office account and can directly request print_referral.php or trend_form.php with arbitrary patient_id values. Patient IDs can be enumerated to broaden the disclosure.
What information may be exposed?
The issue can expose patient demographics, insurance data, and vitals history, which are PHI.
How can I determine whether my deployment is affected?
Deployments running OpenEMR before 8.5.0 are affected. A practical check is whether a Front Office account without patients:med permission can retrieve another patient's information by directly requesting either affected endpoint with that patient's patient_id.