CVE-2026-24908: OpenEMR has SQL Injection in Patient API Sort Parameter
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injection vulnerability in the Patient REST API endpoint allows authenticated users with API access to execute arbitrary SQL queries through the sort parameter. This could potentially lead to database access, PHI (Protected Health Information) exposure, and credential compromise. The issue occurs when user-supplied sort field names are used in ORDER BY clauses without proper validation or identifier escaping. Version 8.0.0 fixes the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24908?
CVE-2026-24908 is classified as a high severity SQL injection vulnerability affecting OpenEMR versions prior to 8.0.0.
How do I fix CVE-2026-24908?
To remediate CVE-2026-24908, you should upgrade OpenEMR to version 8.0.0 or later.
Who is affected by CVE-2026-24908?
CVE-2026-24908 affects authenticated users of OpenEMR who have API access to the Patient REST API endpoint.
What type of vulnerability is CVE-2026-24908?
CVE-2026-24908 is an SQL injection vulnerability that allows for arbitrary SQL queries execution.
What component of OpenEMR does CVE-2026-24908 impact?
CVE-2026-24908 impacts the Patient REST API endpoint within OpenEMR.