What is GHSA-xfhv-f3c4-7vww?

GHSA-xfhv-f3c4-7vww is a security advisory published by GitHub Security Advisories with High severity. OpenEMR before 8.5.0 contains a missing authorization vulnerability in print_referral.php and...

Which CVE IDs does GHSA-xfhv-f3c4-7vww cover?

GHSA-xfhv-f3c4-7vww covers the following CVE IDs: CVE-2026-126471. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xfhv-f3c4-7vww?

GHSA-xfhv-f3c4-7vww has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-xfhv-f3c4-7vwwHighCVSS 6.5

OpenEMR before 8.5.0 contains a missing authorization vulnerability in print_referral.php and...

Vendor

GitHub Security Advisories

Published

November 13, 2026

Last Modified

November 13, 2026

🔗 CVE IDs covered (1)

CVE-2026-126471 →

📋 Description

OpenEMR before 8.5.0 contains a missing authorization vulnerability in print_referral.php and trend_form.php that allows low-privileged Front Office users to access patient PHI without patients:med permission. Attackers can directly request these endpoints with arbitrary patient_id values to retrieve patient demographics, insurance data, and vitals history, enumerating IDs to expand disclosure.

🔗 References (4)

https://github.com/openemr/openemr/security/advisories/GHSA-h9rv-wxcp-x85f
https://nvd.nist.gov/vuln/detail/CVE-2026-126471
https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-print-referral-php-and-trend-form-php
https://github.com/advisories/GHSA-xfhv-f3c4-7vww