CVE-2026-32120: OpenEMR has IDOR in Fee Sheet Product Save
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an Insecure Direct Object Reference (IDOR) vulnerability in the fee sheet product save logic (library/FeeSheet.class.php) allows any authenticated user with fee sheet ACL access to delete, modify, or read drugsales records belonging to arbitrary patients by manipulating the hidden prod[][saleid] form field. The save() method uses the user-supplied saleid in five SQL queries (SELECT, UPDATE, DELETE) without verifying that the record belongs to the current patient and encounter. Version 8.0.0.3 contains a patch.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32120?
CVE-2026-32120 is classified as a medium-severity vulnerability due to its potential impact on user data and access controls.
How do I fix CVE-2026-32120?
To fix CVE-2026-32120, update to OpenEMR version 8.0.0.3 or later as it addresses the Insecure Direct Object Reference issue.
What versions of OpenEMR are affected by CVE-2026-32120?
OpenEMR versions prior to 8.0.0.3 are affected by CVE-2026-32120.
What type of vulnerability is CVE-2026-32120?
CVE-2026-32120 is an Insecure Direct Object Reference (IDOR) vulnerability.
Who should be concerned about CVE-2026-32120?
Any OpenEMR users running versions prior to 8.0.0.3 should be concerned about CVE-2026-32120 as it poses risks to patient confidentiality and data integrity.