CVE-2026-126432

OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/list reports.php that allows read-only users to transmit lab orders because the patients/med check ignores write permission. Authenticated attackers can submit form xmit with arbitrary procedure order IDs to send HL7 orders containing SSNs, insurance, and diagnoses to laboratories and mark them transmitted.