Insecure Direct Object Reference in OpenEMR's Fee Sheet Management

CVE-2026-32120

What is CVE-2026-32120?

OpenEMR, a widely-used open-source electronic health records and medical practice management application, has an Insecure Direct Object Reference vulnerability affecting its fee sheet management functionality. This flaw allows authenticated users with fee sheet ACL access to manipulate the hidden prod[][sale_id] form field, enabling them to delete, modify, or read drug_sales records belonging to any patient. By exploiting this vulnerability, malicious actors can gain unauthorized access to sensitive patient information. The issue arises because the save() method uses user-supplied sale_id in SQL queries without adequately validating ownership. A patch addressing this vulnerability was introduced in version 8.0.0.3 of OpenEMR.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References