CVE-2026-32120 Details
Description
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an Insecure Direct Object Reference (IDOR) vulnerability in the fee sheet product save logic (`library/FeeSheet.class.php`) allows any authenticated user with fee sheet ACL access to delete, modify, or read `drug_sales` records belonging to arbitrary patients by manipulating the hidden `prod[][sale_id]` form field. The `save()` method uses the user-supplied `sale_id` in five SQL queries (SELECT, UPDATE, DELETE) without verifying that the record belongs to the current patient and encounter. Version 8.0.0.3 contains a patch.
A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in OpenEMR versions prior to 8.0.0.3. This vulnerability exists in the fee sheet product save logic within the file 'library/FeeSheet.class.php'. It allows any authenticated user with fee sheet ACL access to delete, modify, or read 'drug_sales' records of any patient by manipulating the hidden 'prod[][sale_id]' form field. The 'save()' method processes the user-supplied 'sale_id' without verifying if the record belongs to the current patient and encounter, leading to unauthorized access and modification of patient records.
Users can update to OpenEMR version 8.0.0.3, which includes a patch for this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openemr/openemr/security/advisories/GHSA-pvvj-mv7h-7847 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/openemr/openemr/commit/c5b4dd8caf2af70617cc58d39188621ed90543dc | [email protected] | Patch |
| https://github.com/openemr/openemr/releases/tag/v8_0_0_3 | [email protected] | Product |
| https://github.com/openemr/openemr/security/advisories/GHSA-pvvj-mv7h-7847 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| open-emr openemr | < 8.0.0.3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 26, 2026 | Initial Analysis | [email protected] |
| Mar 26, 2026 | CVE Modified | CISA-ADP |
| Mar 25, 2026 | New CVE Received | [email protected] |