Improper access control in OpenEMR - #VU158854
Published: November 3, 2026
Vulnerability identifier: #VU158854
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose other patients' laboratory-order information and modify their procedure orders without authorization.
The vulnerability exists due to missing authorization checks in OpenEMR's interface/forms/procedure_order/common.php when handling procedure-order read and save requests. A remote user can supply another patient's global order ID to read its details and, after selecting the target patient and encounter in the session, submit a save request to alter clinical history, diagnoses, patient instructions, ordered tests, and other order data without the required laboratory permission.
Affected software
OpenEMR
Remediation
Install security update from vendor's website.
OpenEMR - update to 8.5.0