PT-2026-146738

CVE-2026-126452

Published

2026-11-13

Updated

2026-11-13

Description by

CVSS 3.1

7.1

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.5.0

Description An authorization flaw exists in the 'diagnosis full.php' endpoint. Authenticated users can manipulate the id parameter to delete or clear billing records belonging to other patients, leading to the deactivation of charges and corruption of financial data.

Recommendations Update to version 8.5.0 or later. As a temporary mitigation, restrict access to the 'diagnosis full.php' file.

Exploitability

Exploit

Fix

Impacts

Researchers

Farisv

Gracia-Gu

Philipphil

Vendors

Affected products

Weakness enumeration