CVE-2026-126443

OpenEMR versions prior to 8.5.0 are susceptible to a missing authorization vulnerability within the dynamic_finder_ajax.php component. This flaw allows authenticated users lacking patients/demo permissions to query sensitive patient demographics. By supplying arbitrary patient_data columns via th...