Advisory · CVE-2026-49142
Authenticated SQL injection in OpenEMR syndromic surveillance leads to admin takeover
OpenEMR before 8.5.0 lets an authenticated user with Clinician-level privileges exploit SQL injection in the Syndromic Surveillance module to extract all user credentials and reset any password, taking over administrative accounts. It is rated high at CVSS 8.8.
- Vendor
- OpenEMR
- Product
- OpenEMR
- Identifier / CWE
- CVE-2026-49142
CWE-89 - Action timing
- Immediate
Explain it like I’m five
OpenEMR builds a database query by gluing clinician search values straight into it, in a spot where quotes cannot help. A clinician-level user crafts a value that rewrites the query, spills every login credential, and then changes the admin password to one they choose.
- 01Clinician session
An attacker authenticates with Clinician-level privileges in OpenEMR.
- 02Injection point
Crafted values in the syndromic surveillance search parameter are imploded directly into an unquoted numeric SQL clause.
- 03Credential extraction
Error-based extraction leaks usernames and bcrypt password hashes from the user credential table.
- 04Password reset
Stacked queries reset a target password, giving full administrative access.
What happened
OpenEMR disclosed CVE-2026-49142 in versions before 8.5.0: the Syndromic Surveillance module search endpoint accepts a form_icd_codes parameter whose values are imploded directly into an unquoted SQL IN clause. The sanitizer only escapes quotes and backslashes, which provides no protection in an unquoted numeric context. An authenticated user with Clinician-level privileges can use error-based extraction to read all user credentials including bcrypt hashes, and stacked queries to reset any user password. It is rated high at CVSS 3.1 8.8, with low privileges required and no user interaction.
OpenEMR is widely deployed open-source electronic health record software, so a clinician-to-admin takeover can expose patient records and the administrative controls around them. The advisory includes a working exploitation script, which raises the urgency of patching.
What to do
- Inventory OpenEMR instances and confirm their version.
- Upgrade OpenEMR to version 8.5.0 or later.
- Restrict Syndromic Surveillance module access to only the clinicians who need it while patching.
- Review database and application logs for unusual syndromic surveillance searches, error responses, and password changes.
- Force password resets for administrative accounts and review accounts created or modified unexpectedly.
Management note
A published exploit script plus clinician-to-admin escalation in health record software is a fast patch. Treat any pre-8.5.0 instance with clinician accounts as exposed.