EUVD-2026-124957

OpenEMR before 8.5.0 contains a mass assignment vulnerability in ObservationController::processEnhancedFormSave that allows authenticated low-privilege users to forge authorization flags through an incomplete field blacklist. Attackers can submit authorized=1 or override the id field alongside...

CVE-2026-126467

OpenEMR versions prior to 8.5.0 are vulnerable to a mass assignment vulnerability within the ObservationController::processEnhancedFormSave() function. The root cause is an incomplete field blacklist , which allows authenticated low-privilege users to forge authorization flags. Specifically, an a...

CVE-2026-126485

OpenEMR versions prior to 8.5.0 are vulnerable to a Cross-Site Request Forgery (CSRF) flaw within the ObservationController::deleteAction component. The root cause is the lack of a CSRF token for the delete.php functionality. An attacker can trick a logged-in clinician into visiting a page that i...

EUVD-2026-124939

OpenEMR before 8.5.0 contains a cross-site request forgery vulnerability in ObservationController::deleteAction that allows attackers to delete observation form records without a CSRF token. Attackers can lure a logged-in clinician to a page issuing a GET to delete.php with guessed id values,...