CVE-2026-126470
Awaiting Analysis Awaiting Analysis - Queue

Insecure Direct Object Reference in OpenEMR Carecoordination Module

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the Carecoordination module that allows authenticated users with send_to_hie permission to access any patient's CCDA/CCR/QRDA documents. Attackers can supply arbitrary document or patient IDs to download, transmit, or export patient health records, inject falsified clinical data, and delete audit records.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126470
EUVD
EUVD-2026-124954

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openemr openemr to 8.5.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenEMR versions before 8.5.0 have an insecure direct object reference flaw in the Carecoordination module. Authenticated users with the send_to_hie permission can manipulate document or patient IDs to access, download, or export any patient's CCDA/CCR/QRDA health records without proper authorization.

Detection Guidance

Check OpenEMR versions before 8.5.0 for the Carecoordination module. Review access logs for unauthorized document downloads or deletions. Inspect user permissions for send_to_hie access. Monitor network traffic for unusual data exfiltration.

Impact Analysis

Attackers could steal sensitive patient health data, inject falsified clinical information into records, or delete audit logs to cover their tracks. This could lead to privacy breaches, incorrect medical decisions, or legal consequences for affected patients and healthcare providers.

Compliance Impact

This vulnerability likely violates HIPAA due to unauthorized access to protected health information and GDPR due to processing personal data without lawful basis. It could result in fines, legal penalties, and reputational damage for organizations failing to protect patient data.

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later. Remove send_to_hie permissions from unauthorized users. Implement strict access controls for patient document access. Review and audit all document transactions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126470. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...