4 matches found
CVE-2026-126416
OpenEMR before 8.5.0 contains an improper authorization vulnerability in patienttrackerstatus.php that allows low-privilege authenticated users to modify other patients' tracker entries by supplying arbitrary trackerid values. Attackers can post statustype and roomnum parameters with a valid CSRF...
CVE-2026-126416 OpenEMR before 8.5.0 Improper Authorization via patient_tracker_status.php
OpenEMR before 8.5.0 contains an improper authorization vulnerability in patienttrackerstatus.php that allows low-privilege authenticated users to modify other patients' tracker entries by supplying arbitrary trackerid values. Attackers can post statustype and roomnum parameters with a valid CSRF...
CVE-2026-126416
OpenEMR versions before 8.5.0 are affected by an improper authorization vulnerability in the patient_tracker_status.php component. This flaw allows low-privilege authenticated users to modify other patients' tracker entries by providing arbitrary tracker_id values. By posting statustype and roomn...
EUVD-2026-125027
OpenEMR before 8.5.0 contains an improper authorization vulnerability in patienttrackerstatus.php that allows low-privilege authenticated users to modify other patients' tracker entries by supplying arbitrary trackerid values. Attackers can post statustype and roomnum parameters with a valid CSRF...