Authorization bypass through user-controlled key in OpenEMR - CVE-2026-126452
Published: November 10, 2026 / Updated: November 13, 2026
Vulnerability identifier: #VU164466
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-126452
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to deactivate or clear billing records belonging to any patient, corrupt financial records, and disrupt billing workflows.
The vulnerability exists due to missing authorization checks and patient or encounter scoping in OpenEMR's diagnosis_full.php deleteBilling and clearBilling functions when processing user-controlled billing record IDs. A remote user can submit GET requests containing a known or guessed billing record ID to deactivate or clear the targeted record regardless of ownership or role.
Affected software
OpenEMR
How to mitigate CVE-2026-126452
Install security update from vendor's website.
OpenEMR - update to 8.5.0