OpenEMR, the open-source electronic health records system used by clinics around the world, carries a critical SQL injection flaw that could let a logged-in user with only low-level access extract patient records and staff password hashes. The vulnerability, tracked as CVE-2026-124469, was published on 8 November 2026 and carries a CVSS score of 9.4, the highest severity rating.

The problem sits in the Fee Sheet drug-inventory lookup, in a component called DrugSalesService::sellDrug. It takes a value from the prod[N][warehouse] field of a submitted form and places it directly into an ORDER BY clause in a database query, without the safeguards that would stop injected code from running. An authenticated user with limited privileges can exploit that gap with a time-based blind SQL injection, slowly drawing data out of the database through carefully timed queries.

According to the vulnerability record, the data within reach includes patient records and the bcrypt password hashes stored in the users_secure table, which protects staff login credentials. The flaw affects OpenEMR versions before 8.3.0, and the fix is included in version 8.3.0. No exploitation in the wild has been reported, and the flaw does not appear in the US CISA catalogue of known exploited vulnerabilities.

Clinics running OpenEMR should upgrade to version 8.3.0 as soon as possible, and until the upgrade is done they should review which accounts can reach the Fee Sheet and watch for unusual database activity. The disclosure is one of several OpenEMR flaws published on the same day, but it is a distinct defect from the access-control flaw tracked as CVE-2026-124488, which affects a different part of the system.