CVE-2026-32120

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an Insecure Direct Object Reference (IDOR) vulnerability in the fee sheet product save logic (`library/FeeSheet.class.php`) allows any authenticated user with fee sheet ACL access to delete, modify, or read `drug_sales` records belonging to arbitrary patients by manipulating the hidden `prod[][sale_id]` form field. The `save()` method uses the user-supplied `sale_id` in five SQL queries (SELECT, UPDATE, DELETE) without verifying that the record belongs to the current patient and encounter. Version 8.0.0.3 contains a patch.

• CWE-639

• https://github.com/openemr/openemr/commit/c5b4dd8caf2af70617cc58d39188621ed90543dcPatch
• https://github.com/openemr/openemr/releases/tag/v8_0_0_3Product
• https://github.com/openemr/openemr/security/advisories/GHSA-pvvj-mv7h-7847Exploit, Vendor Advisory
• https://github.com/openemr/openemr/security/advisories/GHSA-pvvj-mv7h-7847Exploit, Vendor Advisory

Published

Mar 25, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32114Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2026-32116Magic Wormhole makes it possible to get arbitrary-sized file…8.1
• CVE-2026-32117The grafanacubism-panel plugin allows use of cubism.js in Gr…5.4
• CVE-2026-32118OpenEMR is a free and open source electronic health records …9
• CVE-2026-32119OpenEMR is a free and open source electronic health records …4.4
• CVE-2026-3212Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2026-32121OpenEMR is a free and open source electronic health records …5.4
• CVE-2026-32122OpenEMR is a free and open source electronic health records …4.3
• CVE-2026-32123OpenEMR is a free and open source electronic health records …6.5
• CVE-2026-32124OpenEMR is a free and open source electronic health records …5.4
• CVE-2026-32125OpenEMR is a free and open source electronic health records …5.4
• CVE-2026-32126OpenEMR is a free and open source electronic health records …8.1