CVE-2026-32122

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, the Claim File Tracker feature exposes an AJAX endpoint that returns billing claim metadata (claim IDs, payer info, transmission logs). The endpoint does not enforce the same ACL as the main billing/claims workflow, so authenticated users without appropriate billing permissions can access this data. This vulnerability is fixed in 8.0.0.1.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Mar 11, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-321236.5OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, sensitivity check CVE-2026-321245.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, the dynamic code CVE-2026-321255.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, track/item names CVE-2026-321268.1OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, an inverted boole CVE-2026-321278.8OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, OpenEMR contains CVE-2026-321286.3FastGPT is an AI Agent building platform. In 4.14.7 and earlier, FastGPT's Python Sandbox (fastgpt-sandbox) includes guardrails intended to CVE-2026-321298.7soroban-poseidon provides Poseidon and Poseidon2 cryptographic hash functions for Soroban smart contracts. Poseidon V1 (PoseidonSponge) acce CVE-2026-32134.7Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows C CVE-2026-321307.5ZITADEL is an open source identity management platform. From 2.68.0 to before 3.4.8 and 4.12.2, Zitadel provides a System for Cross-domain I CVE-2026-321317.7ZITADEL is an open source identity management platform. Prior to 3.4.8 and 4.12.2, a vulnerability in Zitadel's Management API has been repo CVE-2026-321327.4ZITADEL is an open source identity management platform. Prior to 3.4.8 and 4.12.2, a potential vulnerability exists in Zitadel's passkey reg CVE-2026-321339.12FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 6.1.0, a blind SSRF vulne