CVE-2026-126422

OpenEMR before 8.5.0 contains a missing authorization vulnerability in library/ajax/lists touch.php that allows restricted authenticated users to mark another patient's clinical lists as reviewed. Attackers can submit arbitrary patient id and type values to falsely record "None known" allergy, medication, or problem lists, misleading clinicians and skewing quality-measure calculations.