Openemr
CVE-2026-32120
MEDIUM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Impact | The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) indicates this vulnerability requires network access and low attack complexity with low privileges (authenticated user with fee sheet ACL), resulting in high integrity impact but no confidentiality or availability impact—a realistic score of 6.5 for data tampering. The real-world risk is elevated by several factors: (1) the vulnerability requires only basic authentication and ACL permissions, not advanced privilege escalation; (2) the attack is completely automatable with no user interaction needed; (3) the technical impact is significant in healthcare contexts where drug sales records directly affect patient safety, billing accuracy, and audit trails; (4) a confirmed patch exists in version 8.0.0.3, indicating the vendor has validated the fix. However, the lack of confirmed public POC code or KEV designation suggests this vulnerability is not currently being actively exploited at scale. For healthcare organizations, this should be treated as a high operational priority due to the sensitive nature of the data and regulatory compliance implications (HIPAA), despite the moderate CVSS score. |
| Exploit ScenarioDerived | A disgruntled clinic staff member with fee sheet ACL permissions could systematically enumerate sale_id values and modify or delete drug sales records across multiple patients' encounters to inflate their own sales commissions or disrupt competitor staff metrics. Alternatively, an attacker with initial access as an authenticated low-privilege user could escalate impact by modifying high-value drug sales records to artificially increase inventory costs or create billing discrepancies. The attack requires no user interaction, can be fully automated via direct HTTP requests with manipulated form parameters, and leaves evidence only if detailed audit logging of the prod[][sale_id] field changes is enabled. Given the low attack complexity and low privilege requirement, any authenticated user with fee sheet ACL—including temporary staff or contractors—represents an exploitation vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
An Insecure Direct Object Reference (IDOR) vulnerability exists in OpenEMR versions prior to 8.0.0.3 within the fee sheet product save logic that allows authenticated users with fee sheet ACL permissions to arbitrarily read, modify, or delete drug_sales records belonging to any patient by manipulating the hidden prod[][sale_id] form field. The vulnerability stems from insufficient authorization checks in the FeeSheet.class.php library, where user-supplied sale_id values are used directly in SQL queries without verifying ownership of the record to the current patient and encounter. With a CVSS score of 6.5 and confirmed patch availability in version 8.0.0.3, this represents a moderate-severity data integrity and confidentiality risk affecting healthcare data.
RemediationAI
Immediately upgrade OpenEMR to version 8.0.0.3 or later, which contains the authoritative patch that adds proper ownership verification to the FeeSheet.class.php save() method. Apply the specific patch from commit c5b4dd8caf2af70617cc58d39188621ed90543dc if immediate full upgrade is not feasible. As a temporary compensating control pending patching, restrict fee sheet ACL access to only trusted administrative users and implement detailed audit logging of all fee sheet modifications including sale_id changes. Network-level segmentation should ensure OpenEMR is only accessible to authorized staff via VPN or internal networks. Review audit logs for any suspicious fee sheet modifications that may indicate prior exploitation, particularly cross-patient or cross-encounter drug sales record changes. After patching, conduct a full audit of drug_sales records to detect any unauthorized modifications.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the OpenEMR application (cpe:2.3:a:openemr:openemr:*:*:*:*:*:*:*:*), specifically within the library/FeeSheet.class.php file's save() method. OpenEMR is a PHP-based electronic health records and medical practice management system. The root cause is classified under CWE-639 (Authorization Bypass Through User-Controlled Key), where the application fails to enforce proper authorization boundaries at the object level. The save() method processes five SQL queries (SELECT, UPDATE, DELETE operations) that directly incorporate user-controlled sale_id parameters from hidden form fields without server-side validation that the sale_id belongs to the authenticated user's current patient context or encounter. This is a classic IDOR vulnerability where the indirect reference (sale_id) can be enumerated or manipulated to access records outside the user's intended authorization scope.
Know when Openemr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an Insecure Direct Object Reference (IDOR) vulnerability in the fee sheet product save logic (library/FeeSheet.class.php) allows any authenticated user with fee sheet ACL access to delete, modify, or read drug_sales records belonging to arbitrary patients by manipulating the hidden prod[][sale_id] form field. The save() method uses the user-supplied sale_id in five SQL queries (SELECT, UPDATE, DELETE) without verifying that the record belongs to the current patient and encounter. Version 8.0.0.3 contains a patch.
Executive ViewAI
Organizations using OpenEMR should be aware of notable risk from CVE-2026-32120, a IDOR vulnerability rated CVSS 6.5. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)GitHub Advisory
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to
Unauthenticated token disclosure in OpenEMR before 8.0.0. CVSS 10.0. PoC and patch available.
Path traversal in OpenEMR 7.0.4 disposeDocument() allows file access. PoC available.
Path traversal in OpenEMR electronic health records before fix allows authenticated users to read arbitrary files on the
SQL injection in OpenEMR electronic health records before fix. Authenticated users can execute arbitrary SQL through the
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.cl
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid par
Information disclosure in OpenEMR 5.0.2 to before 8.0.0 exposes sensitive data. PoC and patch available.
Remote code execution in OpenEMR through 8.2.0 lets an authenticated administrator poison the document category tree so
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shel
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote
Exploit-DB