EUVD-2026-124957

OpenEMR before 8.5.0 contains a mass assignment vulnerability in ObservationController::processEnhancedFormSave that allows authenticated low-privilege users to forge authorization flags through an incomplete field blacklist. Attackers can submit authorized=1 or override the id field alongside...

CVE-2026-126467

OpenEMR versions prior to 8.5.0 are vulnerable to a mass assignment vulnerability within the ObservationController::processEnhancedFormSave() function. The root cause is an incomplete field blacklist , which allows authenticated low-privilege users to forge authorization flags. Specifically, an a...