CVE-2026-24908 - Vulnerability Analysis

Overview

OpenEMR < 8.0.0 contains an SQL injection caused by improper validation of the _sort parameter in the Patient REST API endpoint, letting authenticated API users execute arbitrary SQL queries.

Severity & Score

Impact

Authenticated API users can execute arbitrary SQL queries, potentially exposing PHI and compromising credentials.

Mitigation

Upgrade to version 8.0.0 or later.

References

• https://github.com/openemr/openemr/commit/943e23cad6e979f87cdf168807fce2a7b32dd194
• https://github.com/openemr/openemr/security/advisories/GHSA-rcc2-45v3-qmqm

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 25, 2026

🔴 CVE-2026-24908 - Critical (9.9) OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injection vulnerability in the Patient REST API endpoint allows authenticated users with API access to execute ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24908/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner