7 matches found
CVE-2026-126445
OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to modify arbitrary Patient Flow Board trackers without the patients/appt permission. Attackers can submit a victim trackerid to patienttrackerstatus.php or drugscreencompleted.php to falsi...
CVE-2026-126416
OpenEMR before 8.5.0 contains an improper authorization vulnerability in patienttrackerstatus.php that allows low-privilege authenticated users to modify other patients' tracker entries by supplying arbitrary trackerid values. Attackers can post statustype and roomnum parameters with a valid CSRF...
CVE-2026-126416 OpenEMR before 8.5.0 Improper Authorization via patient_tracker_status.php
OpenEMR before 8.5.0 contains an improper authorization vulnerability in patienttrackerstatus.php that allows low-privilege authenticated users to modify other patients' tracker entries by supplying arbitrary trackerid values. Attackers can post statustype and roomnum parameters with a valid CSRF...
CVE-2026-126416
OpenEMR versions before 8.5.0 are affected by an improper authorization vulnerability in the patient_tracker_status.php component. This flaw allows low-privilege authenticated users to modify other patients' tracker entries by providing arbitrary tracker_id values. By posting statustype and roomn...
EUVD-2026-125027
OpenEMR before 8.5.0 contains an improper authorization vulnerability in patienttrackerstatus.php that allows low-privilege authenticated users to modify other patients' tracker entries by supplying arbitrary trackerid values. Attackers can post statustype and roomnum parameters with a valid CSRF...
CVE-2026-126445
OpenEMR versions before 8.5.0 are vulnerable to a missing authorization vulnerability in the Patient Flow Board Tracker endpoints. This flaw allows any authenticated core user lacking the necessary patients/appt permission to modify arbitrary Patient Flow Board trackers. By submitting a victim tr...
EUVD-2026-124994
OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to modify arbitrary Patient Flow Board trackers without the patients/appt permission. Attackers can submit a victim trackerid to patienttrackerstatus.php or drugscreencompleted.php to falsi...