Improper access control in OpenEMR - #VU158864
Published: November 3, 2026
Vulnerability identifier: #VU158864
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose other patients' prescription information across patient and squad boundaries.
The vulnerability exists due to improper access control in the OpenEMR CAMOS prescription printer when processing submitted prescription identifiers without checking patient ownership or prescription permissions. A remote user can submit a forged chrx_ checkbox name containing another patient's global prescription ID to retrieve the prescription's drug name, strength, quantity, dosage form, route, interval, directions, and refill count.
Affected software
OpenEMR
Remediation
Install security update from vendor's website.
OpenEMR - update to 8.5.0