CVE-2026-124468 OpenEMR before 8.3.0 SQL Injection via Patient Insurance and Employer REST API

High 7.1 Published 8 Nov 2026 Updated 12 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-124468?

CVE-2026-124468 is a high-severity vulnerability in openemr, published on 8 Nov 2026.

Official description

OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Standard REST API patient insurance and employer search, which concatenates query-string parameter names into SQL as column identifiers without escaping. Authenticated clients, including low-privilege patient-portal OAuth2 tokens, can send crafted parameter names to /api/patient/{puuid}/insurance or /api/patient/{puuid}/employer to extract patient PHI, user records, and API client secrets.

Weakness: CWE-89

Which versions are affected by CVE-2026-124468?

How do I fix CVE-2026-124468?

No fix has been published for CVE-2026-124468 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-124468 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-124468 exists.

Sources

Also known as GHSA-fhc4-8f9p-8mcc, GHSA-xx67-hf9j-67wx.