CVE-2026-126432

EUVD-2026-125011
OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/list_reports.php that allows read-only users to transmit lab orders because the patients/med check ignores write permission. Authenticated attackers can submit form_xmit with arbitrary procedure order IDs to send HL7 orders containing SSNs, insurance, and diagnoses to laboratories and mark them transmitted.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.9 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 22.65%
Common Weakness Enumeration
References
https://github.com/openemr/openemr/security/advisories/GHSA-3xjm-656g-cfj5
https://www.vulncheck.com/advisories/openemr-before-8.5.0-improper-authorization-in-lab-order-transmission-via-list-reports-php
https://github.com/openemr/openemr/security/advisories/GHSA-3xjm-656g-cfj5