CVE-2026-32120 PUBLISHED

OpenEMR has IDOR in Fee Sheet Product Save

Assigner: GitHub_M
Reserved: 10.03.2026 Published: 25.03.2026 Updated: 26.03.2026

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an Insecure Direct Object Reference (IDOR) vulnerability in the fee sheet product save logic (library/FeeSheet.class.php) allows any authenticated user with fee sheet ACL access to delete, modify, or read drug_sales records belonging to arbitrary patients by manipulating the hidden prod[][sale_id] form field. The save() method uses the user-supplied sale_id in five SQL queries (SELECT, UPDATE, DELETE) without verifying that the record belongs to the current patient and encounter. Version 8.0.0.3 contains a patch.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS Score: 6.5

Product Status

Vendor openemr
Product openemr
Versions
  • Version < 8.0.0.3 is affected

References

Problem Types

  • CWE-639: Authorization Bypass Through User-Controlled Key CWE