What is the CVSS score of CVE-2026-32120?

CVE-2026-32120 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-32120?

Organizations using OpenEMR should be aware of notable risk from CVE-2026-32120, a IDOR vulnerability rated CVSS 6.5. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-32120?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

PHP CVE-2026-32120

MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-25 GitHub_M

PHP Authentication Bypass

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 25, 2026 - 22:47 vuln.today

CVE Published

Mar 25, 2026 - 22:27 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an Insecure Direct Object Reference (IDOR) vulnerability in the fee sheet product save logic (library/FeeSheet.class.php) allows any authenticated user with fee sheet ACL access to delete, modify, or read drug_sales records belonging to arbitrary patients by manipulating the hidden prod[][sale_id] form field. The save() method uses the user-supplied sale_id in five SQL queries (SELECT, UPDATE, DELETE) without verifying that the record belongs to the current patient and encounter. Version 8.0.0.3 contains a patch.

AnalysisAI

An Insecure Direct Object Reference (IDOR) vulnerability exists in OpenEMR versions prior to 8.0.0.3 within the fee sheet product save logic that allows authenticated users with fee sheet ACL permissions to arbitrarily read, modify, or delete drug_sales records belonging to any patient by manipulating the hidden prod[][sale_id] form field. The vulnerability stems from insufficient authorization checks in the FeeSheet.class.php library, where user-supplied sale_id values are used directly in SQL queries without verifying ownership of the record to the current patient and encounter. With a CVSS score of 6.5 and confirmed patch availability in version 8.0.0.3, this represents a moderate-severity data integrity and confidentiality risk affecting healthcare data.

Technical ContextAI

The vulnerability resides in the OpenEMR application (cpe:2.3:a:openemr:openemr:*:*:*:*:*:*:*:*), specifically within the library/FeeSheet.class.php file's save() method. OpenEMR is a PHP-based electronic health records and medical practice management system. The root cause is classified under CWE-639 (Authorization Bypass Through User-Controlled Key), where the application fails to enforce proper authorization boundaries at the object level. The save() method processes five SQL queries (SELECT, UPDATE, DELETE operations) that directly incorporate user-controlled sale_id parameters from hidden form fields without server-side validation that the sale_id belongs to the authenticated user's current patient context or encounter. This is a classic IDOR vulnerability where the indirect reference (sale_id) can be enumerated or manipulated to access records outside the user's intended authorization scope.

RemediationAI

Immediately upgrade OpenEMR to version 8.0.0.3 or later, which contains the authoritative patch that adds proper ownership verification to the FeeSheet.class.php save() method. Apply the specific patch from commit c5b4dd8caf2af70617cc58d39188621ed90543dc if immediate full upgrade is not feasible. As a temporary compensating control pending patching, restrict fee sheet ACL access to only trusted administrative users and implement detailed audit logging of all fee sheet modifications including sale_id changes. Network-level segmentation should ensure OpenEMR is only accessible to authorized staff via VPN or internal networks. Review audit logs for any suspicious fee sheet modifications that may indicate prior exploitation, particularly cross-patient or cross-encounter drug sales record changes. After patching, conduct a full audit of drug_sales records to detect any unauthorized modifications.