CVE-2026-126322

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description An unsanitized deserialization issue allows authenticated attackers to manipulate patient-matching criteria. By providing a crafted serialized key parameter to the 'interface/orders/patient match dialog.php' endpoint, attackers can enumerate patients or force matches that associate lab orders with the incorrect patient. Deserialization is the process of converting a serialized string back into an object or data structure.

Recommendations Update to version 8.3.0 or later. As a temporary mitigation, restrict access to the 'interface/orders/patient match dialog.php' endpoint or avoid using the key parameter until the update is applied.