CVE-2026-126488: OpenEMR before 8.5.0 SQL Injection via OnsiteDocument.Query _BitwiseAnd
OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal OnsiteDocument.Query endpoint, where mass-assigned BitwiseAnd criteria parameters are placed unquoted into SQL with only quote-character escaping. Authenticated portal patients can inject SQL outside their per-patient scope to read the entire database, including other patients' demographics and userssecure password hashes.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated patient portal user can exploit it. The attack does not require user interaction and can be performed over the network.
What data could be exposed?
An attacker can read data outside their assigned patient scope, potentially including the entire database. The disclosed examples include other patients' demographic records and users_secure password hashes.
Are installations running version 8.5.0 affected?
The vulnerability is reported in OpenEMR versions before 8.5.0. Installations running a version earlier than 8.5.0 should be treated as affected.