CVE-2026-126445

OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to modify arbitrary Patient Flow Board trackers without the patients/appt permission. Attackers can submit a victim trackerid to patienttrackerstatus.php or drugscreencompleted.php to falsi...

CVE-2026-126445

OpenEMR versions before 8.5.0 are vulnerable to a missing authorization vulnerability in the Patient Flow Board Tracker endpoints. This flaw allows any authenticated core user lacking the necessary patients/appt permission to modify arbitrary Patient Flow Board trackers. By submitting a victim tr...

EUVD-2026-124994

OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to modify arbitrary Patient Flow Board trackers without the patients/appt permission. Attackers can submit a victim trackerid to patienttrackerstatus.php or drugscreencompleted.php to falsi...