# CVE-2026-124468: OpenEMR SQL injection in Standard REST API patient search

Source: https://junglewise.ai/threats/cve-2026-124468-openemr-before-8-3-0-contains-an-sql-injection-vulnerability-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-124468 · Severity: high · CVSS 7.1 · Published 2026-11-08

OpenEMR is an open-source electronic health record and practice management system. A SQL injection vulnerability in the REST API patient insurance and employer search endpoints allows any authenticated user, including low-privilege patient portal accounts, to extract sensitive patient health information, user credentials, and API secrets from the database. An attacker with valid credentials can craft malicious query parameters to execute arbitrary SQL commands.

Technologies: [OpenEMR](https://junglewise.ai/threats/technologies/openemr-openemr). Vendors: [OpenEMR](https://junglewise.ai/threats/vendors/openemr).

## Quick answers

**Is CVE-2026-124468 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-124468 being exploited in the wild.

**How severe is CVE-2026-124468?** High severity, with a CVSS score of 7.1, published 8 November 2026.

**Which products and versions are affected?** OpenEMR before 8.3.0.

**Is there a fix for CVE-2026-124468?** Yes: fixed in 8.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-124468 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-124468?** Check whether you run OpenEMR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 8.3.0

## Technical details

The vulnerability exists in the patient insurance and employer REST API endpoints where query-string parameter names are directly concatenated into SQL statements as column identifiers without escaping. The application only type-wraps uuid/puuid parameters and passes all other keys unfiltered to the search builder, which converts them to StringSearchField entries with the raw parameter name as the SQL column. An authenticated attacker can inject SQL subqueries via parameter names to perform time-based blind extraction, error-based extraction, or execute arbitrary queries against the database.

## Affected products

- OpenEMR OpenEMR before 8.3.0

## Timeline

- 2026-08-18: disclosed
- 2026-11-08: advisory

## References

- [https://github.com/openemr/openemr/commit/e51b0ff9e5b62d43d499d0cd0425290c29ed1212](https://github.com/openemr/openemr/commit/e51b0ff9e5b62d43d499d0cd0425290c29ed1212)
- [https://github.com/openemr/openemr/security/advisories/GHSA-fhc4-8f9p-8mcc](https://github.com/openemr/openemr/security/advisories/GHSA-fhc4-8f9p-8mcc)

## Related threats

- [OpenEMR path traversal in oe-module-faxsms disposeDocument](https://junglewise.ai/threats/cve-2026-124490-openemr-before-8-3-0-contains-a-path-traversal-vulnerability-in)
- [OpenEMR broken access control in portal payment processing](https://junglewise.ai/threats/cve-2026-124489-openemr-before-8-3-0-contains-a-broken-access-control)
- [OpenEMR authorization bypass in encounter form loaders](https://junglewise.ai/threats/cve-2026-124488-openemr-before-8-3-0-contains-an-authorization-bypass)
- [OpenEMR improper authorization in FHIR DocumentReference $docref](https://junglewise.ai/threats/cve-2026-124487-openemr-before-8-4-0-contains-an-improper-authorization)
- [OpenEMR missing authorization in classic document controller](https://junglewise.ai/threats/cve-2026-124486-openemr-before-8-3-0-contains-a-missing-authorization)