CVE-2026-126485: OpenEMR before 8.5.0 CSRF via Observation Form delete.php
OpenEMR before 8.5.0 contains a cross-site request forgery vulnerability in ObservationController::deleteAction that allows attackers to delete observation form records without a CSRF token. Attackers can lure a logged-in clinician to a page issuing a GET to delete.php with guessed id values, soft-deleting observations in the victim's open encounter.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
OpenEMR deployments before 8.5.0 are exposed when a clinician is logged in and has an open encounter containing observation form records. The attacker must be able to induce that clinician's browser to request the vulnerable deletion endpoint.
What does an attacker need to exploit it?
No OpenEMR account or CSRF token is required by the attacker. They need to lure a logged-in clinician to a page that issues a GET request to delete.php and use guessed observation record ID values.
What is the impact of a successful attack?
A successful request soft-deletes observation form records in the victim clinician's open encounter. The available information indicates an integrity impact and does not indicate confidentiality or availability impact.