PT-2026-28136 · Openemr · Openemr

Published 2026-03-25 · Updated 2026-03-25 · CVE-2026-32120

NVD

CVSS v3.1

6.5

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an Insecure Direct Object Reference (IDOR) vulnerability in the fee sheet product save logic (library/FeeSheet.class.php) allows any authenticated user with fee sheet ACL access to delete, modify, or read drug sales records belonging to arbitrary patients by manipulating the hidden prod[][sale id] form field. The save() method uses the user-supplied sale id in five SQL queries (SELECT, UPDATE, DELETE) without verifying that the record belongs to the current patient and encounter. Version 8.0.0.3 contains a patch.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-32120

Affected Products

Openemr

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-32120 · Security Note
• https://github.com/openemr/openemr/commit/c5b4dd8caf2af70617cc58d39188621ed90543dc · Note
• https://github.com/openemr/openemr/releases/tag/v8_0_0_3 · Note
• https://github.com/openemr/openemr/security/advisories/GHSA-pvvj-mv7h-7847 · Note