CVE-2026-126443

OpenEMR before 8.5.0 contains a missing authorization vulnerability in dynamicfinderajax.php that allows authenticated users without patients/demo permission to query patient demographics. Attackers can supply arbitrary patientdata columns via the sColumns parameter to enumerate names, dates of...

CVE-2026-126443

OpenEMR versions prior to 8.5.0 are susceptible to a missing authorization vulnerability within the dynamic_finder_ajax.php component. This flaw allows authenticated users lacking patients/demo permissions to query sensitive patient demographics. By supplying arbitrary patient_data columns via th...

EUVD-2026-125000

OpenEMR before 8.5.0 contains a missing authorization vulnerability in dynamicfinderajax.php that allows authenticated users without patients/demo permission to query patient demographics. Attackers can supply arbitrary patientdata columns via the sColumns parameter to enumerate names, dates of...

CVE-2026-126443 OpenEMR before 8.5.0 Missing Authorization via dynamic_finder_ajax.php Patient Finder

OpenEMR before 8.5.0 contains a missing authorization vulnerability in dynamicfinderajax.php that allows authenticated users without patients/demo permission to query patient demographics. Attackers can supply arbitrary patientdata columns via the sColumns parameter to enumerate names, dates of...