CVE-2026-126467

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.5.0

Description An issue exists in the processEnhancedFormSave() function of the ObservationController where an incomplete field blacklist allows authenticated low-privilege users to perform mass assignment. By submitting authorized=1 or overriding the id field alongside observation id, an attacker can mark observations as Provider-signed or overwrite clinical fields of other observations within the same patient encounter.

Recommendations Update to version 8.5.0 or later. As a temporary mitigation, restrict access to the processEnhancedFormSave() function for low-privilege users.