OpenEMR’s 8.3.0 and 8.4.0 releases fixed a wave of OpenEMR critical vulnerabilities, five flaws in total from the same August and September 2026 disclosure. Two are the fax and SMS module bugs covered on their own pages; the other three are new to this post. OpenEMR rates four of the five Critical and one High. The version that carries every fix is 8.4.0.
What CVE-2026-124469, CVE-2026-124445 and CVE-2026-124463 Let an Attacker Do
CVE-2026-124469 is a SQL injection flaw in OpenEMR’s Fee Sheet drug-inventory lookup, DrugSalesService::sellDrug. The advisory says a per-product warehouse value from the form reaches the ORDER BY clause unsanitized. Any authenticated user who can open the Fee Sheet form can trigger it, and a default install grants that to low-privileged clinical roles such as nurses. The advisory says the resulting read can reach the entire database, including the bcrypt password hashes OpenEMR stores for provider and admin accounts.
CVE-2026-124445 sits in OneTimeAuth, the component that logs patients into the portal from a one-time link. The advisory says the component never enforces the one-time-use and access-count limits a caller sets on a token, and never revokes it after use. Some portal flows also require a PIN, and the advisory says that check has no rate limiting. A captured token or a guessed PIN opens a full patient-portal session exposing protected health information, per the advisory.
CVE-2026-124463 is a stored cross-site scripting flaw in CAMOS, an OpenEMR encounter-form module. The advisory says an authenticated user with CAMOS access can save HTML through ajax_save.php. It runs unencoded when the entry prints through one branch of rx_print.php.
That lets the stored script act and read data as whichever logged-in user views the print, per the advisory. OpenEMR’s own release notes rate this one High, one band under the other two flaws above.
How These OpenEMR Critical Vulnerabilities Compare
VulnCheck is the CNA for all five records. The CVSS v3.1 and v4.0 scores below are both VulnCheck’s; the severity column is OpenEMR’s own rating from its GitHub release notes, not a CVSS band.
| CVE | Flaw | CVSS v3.1 | CVSS v4.0 | OpenEMR severity | Fixed in |
|---|---|---|---|---|---|
| CVE-2026-124450 | Fax/SMS module access control bypass | 9.9 | 9.3 | Critical | 8.3.0 |
| CVE-2026-124490 | RingCentral fax client path traversal | 9.1 | 9.4 | Critical | 8.3.0 |
| CVE-2026-124469 | Fee Sheet SQL injection | 9.9 | 9.4 | Critical | 8.3.0 |
| CVE-2026-124445 | OneTimeAuth token replay and PIN bypass | 9.8 | 9.3 | Critical | 8.4.0 |
| CVE-2026-124463 | CAMOS stored XSS via Rx print | 8.7 | 9.3 | High | 8.3.0 |
What Should You Do Now?
Steps 2 and 3 follow the advisories. Steps 1 and 4 are our own advice.
- Upgrade to OpenEMR 8.4.0This one upgrade carries every fix in this post plus the two fax and SMS module fixes from 8.3.0, so one update closes all five.
- Audit Fee Sheet and CAMOS accessList which roles can open the Fee Sheet form and save CAMOS entries. The advisories say a default install grants both to low-privileged clinical roles, not only billing or admin staff.
- Review one-time portal linksCheck how long patient-portal links stay valid, and review portal access logs for the same one-time token used more times than a single visit should allow.
- Rotate credentials after upgradingIf the Fee Sheet form was reachable by low-privileged roles before you upgraded, rotate database and admin credentials, since the SQL injection could read password hashes.
We cover the fax and SMS module fixes in full on their own pages, the broken access control flaw and the RingCentral path traversal flaw. None of the five flaws in this release is in the CISA Known Exploited Vulnerabilities catalog as of version 2026.11.06. For the weakness classes behind them, see our SQL injection, cross-site scripting and patch management entries.