OpenEMR Missing Authorization in Patient Flow Board

Executive Summary

CVE-2026-126445 is a missing authorization vulnerability in OpenEMR versions before 8.5.0. It allows any authenticated core user to modify Patient Flow Board trackers without the patients/appt permission. Attackers can falsify check-in status, room assignments, drug-screen completion, and tracker history by submitting a victim's tracker_id to specific PHP files.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unauthorized modifications to patient tracker statuses in OpenEMR. Check server logs for unusual activity in patient_tracker_status.php or drug_screen_completed.php. Look for requests with tracker IDs that do not match the authenticated user's permissions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can disrupt clinic operations by allowing unauthorized changes to patient workflow states. It can falsify visit audit trails, leading to incorrect records of patient check-ins, room assignments, and drug-screen completion. Exploitation requires an authenticated core account and knowledge of a target tracker or appointment ID.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later to apply the fix. If upgrading is not immediately possible, enforce ACL checks manually by validating user permissions before processing tracker modifications. Restrict core user access to only necessary functions until the update is applied.

Useful 0 Not Useful 0