PT-2026-28136 · Openemr · Openemr

Published 2026-03-25 · Updated 2026-03-26 · CVE-2026-32120

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0.3

Description OpenEMR is an electronic health records and medical practice management application. A flaw exists in the fee sheet product save logic within library/FeeSheet.class.php that allows authenticated users with fee sheet access to manipulate drug sales records for any patient. This is possible by modifying the hidden prod[][sale id] form field. The save() method utilizes the provided sale id in SQL queries (SELECT, UPDATE, DELETE) without proper verification of patient and encounter association.

Recommendations Update to version 8.0.0.3 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-32120

GHSA-PVVJ-MV7H-7847

Affected Products

Openemr

References · 7

• 🔥 https://github.com/openemr/openemr/security/advisories/GHSA-pvvj-mv7h-7847 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32120.json · Exploit
• https://github.com/openemr/openemr/commit/c5b4dd8caf2af70617cc58d39188621ed90543dc · Patch
• https://osv.dev/vulnerability/CVE-2026-32120 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32120 · Security Note
• https://github.com/openemr/openemr/releases/tag/v8_0_0_3 · Note
• https://twitter.com/CVEnew/status/2037137794921865637 · Twitter Post