CVE-2026-32120 - Vulnerability Analysis

Overview

OpenEMR < 8.0.0.3 contains an Insecure Direct Object Reference caused by lack of ownership verification in fee sheet save logic, letting authenticated users with fee sheet ACL access read, modify, or delete arbitrary patient drug_sales records, exploit requires fee sheet ACL access.

Severity & Score

Impact

Authenticated users with fee sheet ACL access can read, modify, or delete arbitrary patient drug_sales records, risking data integrity and confidentiality.

Mitigation

Update to version 8.0.0.3 or later.

References

• https://github.com/openemr/openemr/commit/c5b4dd8caf2af70617cc58d39188621ed90543dc
• https://github.com/openemr/openemr/releases/tag/v8_0_0_3
• https://github.com/openemr/openemr/security/advisories/GHSA-pvvj-mv7h-7847

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner