OpenEMR Deserialization Flaw Enables Patient Data Manipulation

Executive Summary

CVE-2026-126322 is an unsanitized deserialization vulnerability in OpenEMR versions before 8.3.0. It exists in the Patient Matching Dialog file interface/orders/patient_match_dialog.php where the 'key' parameter is passed directly to unserialize() without validation. Attackers can send crafted PHP serialized arrays to manipulate patient-matching criteria, influencing which patients are associated with lab orders.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your OpenEMR version is prior to 8.3.0 by examining the version file or running SELECT version FROM version WHERE variable='version'; in the database. Monitor network traffic for GET requests to interface/orders/patient_match_dialog.php with serialized parameters in the 'key' field. Look for unusual patient matching behavior or incorrect associations in logs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows authenticated attackers to enumerate patients or force incorrect associations between lab orders and patients. Attackers could link orders to the wrong patient, leading to medical errors, privacy breaches, or patient data exposure. The impact includes incorrect patient data associations and potential unauthorized access to sensitive health information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized patient data exposure and incorrect associations. GDPR requires strict data protection and patient consent, while HIPAA mandates accurate patient data handling. Exploitation could lead to non-compliance, legal penalties, and reputational damage for healthcare providers.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade OpenEMR to version 8.3.0 or later. If upgrading is not possible, implement input validation for the 'key' parameter in patient_match_dialog.php and avoid using unserialize() on untrusted data. Consider signing serialized data with HMAC before processing or replacing serialize/unserialize with JSON payloads protected by HMAC.

Useful 0 Not Useful 0