CVE-2026-126493
Awaiting Analysis Awaiting Analysis - Queue

Stored XSS in OpenEMR Patient Portal via onsiteportalactivity API

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows low-privileged patient portal users to inject JavaScript via the tableArgs field of the onsiteportalactivity API. Attackers can store a payload with spaces that breaks out of an unquoted data-delete-id attribute, executing script when providers click the delete button on the audit review page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126493
EUVD
EUVD-2026-125131

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openemr openemr to 8.5.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in OpenEMR versions before 8.5.0. A low-privileged patient portal user can inject malicious JavaScript via the tableArgs field in the onsiteportalactivity API. The payload breaks out of an unquoted HTML attribute, executing when providers click a delete button on the audit review page.

Detection Guidance

To detect this vulnerability, inspect OpenEMR instances running versions prior to 8.5.0 for suspicious activity in the patient portal's OnsitePortalActivity API. Check server logs for POST requests to /portal/patient/api/onsiteportalactivity with unusual tableArgs values containing JavaScript or HTML payloads. Review audit review pages for unquoted attributes or injected scripts.

Impact Analysis

Attackers could steal sessions, perform unauthorized actions, or forge actions by privileged users. Providers may unknowingly trigger malicious scripts when interacting with the affected delete button, compromising data integrity and confidentiality.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating confidentiality requirements in GDPR and HIPAA. It may result in non-compliance due to potential exposure of sensitive patient data.

Mitigation Strategies

Immediately upgrade OpenEMR to version 8.5.0 or later to patch the vulnerability. If upgrading is not possible, restrict access to the patient portal API endpoint /portal/patient/api/onsiteportalactivity and sanitize all inputs in the tableArgs field to prevent XSS payloads. Monitor audit logs for unauthorized actions or script execution attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126493. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...