CVE-2026-32120

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-32120

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32120.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-32120

Aliases

GHSA-pvvj-mv7h-7847

Published

2026-03-25T22:27:38.208Z

Modified

2026-04-10T05:42:19.353195Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

OpenEMR has IDOR in Fee Sheet Product Save

Details

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an Insecure Direct Object Reference (IDOR) vulnerability in the fee sheet product save logic (library/FeeSheet.class.php) allows any authenticated user with fee sheet ACL access to delete, modify, or read drug_sales records belonging to arbitrary patients by manipulating the hidden prod[][sale_id] form field. The save() method uses the user-supplied sale_id in five SQL queries (SELECT, UPDATE, DELETE) without verifying that the record belongs to the current patient and encounter. Version 8.0.0.3 contains a patch.

Database specific

{
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32120.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/openemr/openemr

Affected ranges

Type

GIT

Repo

https://github.com/openemr/openemr

Events

Introduced

Fixed

7c96c8eefe460d6fadbccbe93d0fa6bf819acd69

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "8.0.0.3"
        }
    ]
}

Affected versions

Other

v2_7_2

v2_7_2-rc1

v2_7_2-rc2

v2_7_3-rc1

v2_8_0

v2_8_1

v2_8_2

v2_8_3

v2_9_0

v3_0_0

v3_0_1

v8_0_0

v8_0_0_1

v8_0_0_2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32120.json"