CVE-2026-126438
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/patient_file/rules/patient_data.php that allows read-only patients/med users to modify clinical-rule records. Attackers can submit a global form_entryID row ID to overwrite completion date, state, and result, including records of patients outside their configured squad.