CVE-2026-124444

CVSS 7.1 (high) · published 2026-11-08

OpenEMR before 8.4.0 contains a mass assignment vulnerability in the patient portal OnsiteDocument query API that lets request parameters set bitwise criteria filters whose values are placed unquoted into the SQL WHERE clause. Authenticated patient portal users can inject SQL via parameters such as Id_BitwiseAnd to read any database table, including other patients' records and staff password hashes.

Weakness: CWE-89

Source: NVD CVE-2026-124444

References

• https://github.com/openemr/openemr/security/advisories/GHSA-hx8r-g8gw-6g2j
• https://www.vulncheck.com/advisories/openemr-before-8.4.0-sql-injection-via-onsitedocument-query-api
• https://github.com/openemr/openemr/security/advisories/GHSA-hx8r-g8gw-6g2j

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.