CVE-2026-126434
Awaiting Analysis Awaiting Analysis - Queue

Missing Authorization in OpenEMR Procedure Orders

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
OpenEMR before 8.5.0 contains a missing authorization vulnerability in interface/forms/procedure_order/common.php that allows authenticated accounts lacking patients/lab permission to read and modify other patients' procedure orders. Attackers can request a global order id to disclose clinical history, or select the target patient in their session and submit bn_save to falsify diagnoses, instructions, and order status.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126434
EUVD
EUVD-2026-125009

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openemr openemr to 8.5.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-126434 is a missing authorization vulnerability in OpenEMR versions before 8.5.0. It exists in the procedure order form file interface/forms/procedure_order/common.php. Authenticated users without proper patient or lab permissions can read and modify other patients' procedure orders. Attackers can exploit this by requesting a global order ID to access clinical history or by submitting a forged request to falsify diagnoses, instructions, and order status.

Detection Guidance

To detect this vulnerability, check OpenEMR versions prior to 8.5.0 by running: grep -r 'openemr' /var/www/html/openemr/version.php or check the version in the web interface. Review logs for unauthorized access to interface/forms/procedure_order/common.php or suspicious modifications to procedure orders.

Impact Analysis

This vulnerability allows unauthorized access to sensitive medical data, including clinical history and procedure orders of other patients. Attackers can falsify diagnoses, instructions, and order status, potentially leading to incorrect clinical decisions or corrupted laboratory workflows. It requires an authenticated account without specific permissions but can have serious consequences for patient care and data integrity.

Compliance Impact

This vulnerability likely violates compliance with standards like GDPR and HIPAA due to unauthorized access and modification of protected health information. GDPR requires strict access controls and data protection, while HIPAA mandates safeguards for patient data. The flaw enables breaches of confidentiality and integrity, posing significant compliance risks for healthcare providers using affected OpenEMR versions.

Mitigation Strategies

Immediately upgrade OpenEMR to version 8.5.0 or later. Ensure proper authorization checks are enforced in interface/forms/procedure_order/common.php. Review and restrict user permissions to prevent unauthorized access to patient data and procedure orders.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126434. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...