CVE-2026-126435

OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/order manifest.php, which checks patients/med without requiring write access or applying patient squad restrictions. Users with only patients/med view permission can request any order ID to read squad-restricted patient data and submit bn save and form omit parameters, without a CSRF token, to set do not send flags that suppress ordered lab procedures.