CVE-2026-126434

OpenEMR versions prior to 8.5.0 are vulnerable to a missing authorization flaw in interface/forms/procedure_order/common.php. This vulnerability allows authenticated accounts that lack specific patients/lab permissions to access and manipulate procedure orders belonging to other patients. Specifi...