OpenEMR 8.5.0: Twelve CVEs in a Clinical Record System, and Why the Patch Is Half the Response

OpenEMR 8.5.0 fixes roughly twelve CVEs across a dozen endpoints. CVSS 8.8 to 7.1. SQL injection, IDOR, authentication bypass, and missing authorization checks in the admin, billing, and patient-portal surfaces of a clinical record system.

Three things worth highlighting beyond the patch note:

The fix is bigger than the CVE list. 8.5.0 addresses substantially more security advisories than the ~12 that received CVE numbers. Several are documented as GitHub Security Advisories before CVE assignment. Some were credited to AI-assisted code review. A patch process that tracks CVE feeds only sees the announced portion of the fix.

The breach is quiet. An IDOR or a missing capability check on an EMR doesn’t generate a ransom note. It generates a logged-in user making a records request with one digit changed in the URL. The difference between “clerk looked up the wrong patient” and “IDOR across the whole chart” is the difference between a training issue and a HIPAA breach.

The patch doesn’t answer whether the path was used. That’s the post-patch hunt: application logs for sessions reading patient records outside their clinical role, authentication logs for sessions that reached clinical endpoints without an interactive login, record-modification logs for changes without a corresponding encounter.

Full article with hunt guidance, mitigation checklist, and FAQ at the link above
https://threataft.com/articles/openemr-8-5-0-twelve-cves-healthcare-emr