# CVE-2026-124469

OpenEMR SQLi in Fee Sheet allows authenticated low-privilege users to exfiltrate patient data

- Page: https://www.vulneraibility.com/cve/CVE-2026-124469
- CVSS: 9.4
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-89
- Published: 2026-11-08

## Affected versions

- openemr: affected < 8.3.0; fixed in 8.3.0

A version outside these ranges is not a statement that it is unaffected.

## Impact

Authenticated low-privileged SQL injection enables time-based blind exfiltration of patient records and users_secure bcrypt hashes.

## Action

Immediate action required

## Recommendation

Apply OpenEMR 8.3.0/vendor patch immediately; restrict Fee Sheet access and monitor logs

## References

- [advisory] https://github.com/openemr/openemr/security/advisories/GHSA-cg8c-2v5q-29g7
- [advisory] https://www.vulncheck.com/advisories/openemr-before-8.3.0-sql-injection-via-fee-sheet-warehouse-parameter

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.