CVE-2026-126322
HIGH
NVD
CVSS Score
8.1
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
OpenEMR before 8.3.0 contains an unsanitized deserialization vulnerability that allows authenticated attackers to control patient-matching criteria by supplying a crafted serialized key parameter. Attackers can send serialized arrays to interface/orders/patient_match_dialog.php to enumerate patients or force matches that associate lab orders with the wrong patient.