SQL injection in OpenEMR - CVE-2026-24908
Published: April 23, 2026
Vulnerability identifier: #VU127288
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-24908
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary SQL queries.
The vulnerability exists due to SQL injection in the Patient REST API endpoint _sort parameter handling when processing user-supplied _sort query parameters. A remote user can send a specially crafted API request to execute arbitrary SQL queries.
Exploitation requires valid API access with an OAuth2 bearer token, and the REST API must be enabled.
Affected software
OpenEMR
How to mitigate CVE-2026-24908
Install security update from vendor's website.
OpenEMR - update to 8.0.0