---
id: CVE-2026-124444
title: OpenEMR before 8.4.0 SQL Injection via OnsiteDocument Query API
summary: >-
  OpenEMR before 8.4.0 contains a mass assignment vulnerability in the patient
  portal OnsiteDocument query API that lets request parameters set bitwise
  criteria filters whose values are placed unquoted into the SQL WHERE clause.
  Authentica…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-89
vendor: openemr
product: openemr
affected:
  - openemr < 8.4.0
published: '2026-11-08'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T13:15:36.569Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-124444'
references:
  - url: 'https://github.com/openemr/openemr/security/advisories/GHSA-hx8r-g8gw-6g2j'
    label: GitHub Security Advisory (GHSA-hx8r-g8gw-6g2j)
  - url: >-
      https://www.vulncheck.com/advisories/openemr-before-8.4.0-sql-injection-via-onsitedocument-query-api
    label: >-
      VulnCheck Advisory: OpenEMR before 8.4.0 SQL Injection via OnsiteDocument
      Query API
tags:
  - cve.org
ingestedAt: '2026-11-08T13:50:34.978Z'
---

## Overview

OpenEMR before 8.4.0 contains a mass assignment vulnerability in the patient portal OnsiteDocument query API that lets request parameters set bitwise criteria filters whose values are placed unquoted into the SQL WHERE clause. Authenticated patient portal users can inject SQL via parameters such as Id_BitwiseAnd to read any database table, including other patients' records and staff password hashes.

## Affected

- `openemr < 8.4.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.