CVE-2026-124444 OpenEMR before 8.4.0 SQL Injection via OnsiteDocument Query API
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-124444?
CVE-2026-124444 is a high-severity vulnerability in openemr, published on 8 Nov 2026.
Official description
OpenEMR before 8.4.0 contains a mass assignment vulnerability in the patient portal OnsiteDocument query API that lets request parameters set bitwise criteria filters whose values are placed unquoted into the SQL WHERE clause. Authenticated patient portal users can inject SQL via parameters such as Id_BitwiseAnd to read any database table, including other patients' records and staff password hashes.
Weakness: CWE-89
Which versions are affected by CVE-2026-124444?
How do I fix CVE-2026-124444?
No fix has been published for CVE-2026-124444 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-124444 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-124444 exists.
Sources
Also known as GHSA-h4mx-8cw8-cfv2, GHSA-hx8r-g8gw-6g2j.