SQL Injection Vulnerability in OpenEMR by OpenEMR

CVE-2026-124468

What is CVE-2026-124468?

An SQL injection vulnerability exists in the Standard REST API of OpenEMR versions prior to 8.3.0, specifically affecting patient insurance and employer search endpoints. This flaw allows authenticated clients, including those with low-privilege OAuth2 tokens from the patient portal, to construct malicious parameter names that are concatenated into SQL queries as column identifiers, leading to the potential exposure of sensitive patient information, user records, and API client secrets. Threat actors can exploit this vulnerability by targeting the endpoints /api/patient/{puuid}/insurance and /api/patient/{puuid}/employer.

References