CVE-2026-126470

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.5.0

Description The Carecoordination module contains an insecure direct object reference (IDOR) issue. This allows authenticated users with send to hie permission to access CCDA, CCR, or QRDA documents of any patient. By providing arbitrary document or patient IDs, an attacker can download, transmit, or export patient health records, inject falsified clinical data, and delete audit records.

Recommendations Update to version 8.5.0 or later.