Improper access control in OpenEMR - #VU158852
Published: November 3, 2026
Vulnerability details
The vulnerability allows a remote user to transmit arbitrary queued laboratory orders without write permission and alter their transmission state, disrupting laboratory workflows.
The vulnerability exists due to improper access control in OpenEMR's interface/orders/list_reports.php when handling laboratory-order transmission requests. A remote user can submit a POST request with form_xmit and selected procedure-order IDs in form_cb using read-only medical-record permission to transmit orders without write authorization or patient-level authorization checks and mark them as transmitted.
Exploitation requires electronic laboratory order transmission to be configured; the receiving laboratory and transport are determined by the existing procedure-provider configuration.