PT-2026-146724
CVE-2026-126438
·
Published
2026-11-13
·
Updated
2026-11-13
Description by
CVSS 3.1
4.3
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/patient file/rules/patient data.php that allows read-only patients/med users to modify clinical-rule records. Attackers can submit a global form entryID row ID to overwrite completion date, state, and result, including records of patients outside their configured squad.
Found an issue in the description? Have something to add? Feel free to write us 👾