CVE-2026-124473

OpenEMR before 8.3.0 Broken Object Authorization via SOAP Note Update API

OpenEMR before 8.3.0 contains a broken object-level authorization vulnerability in the SOAP note update API, which does not verify that the supplied SOAP note ID (sid) belongs to the supplied patient and encounter. Authenticated users with encounters/notes permission can send PUT requests to /api/patient/:pid/encounter/:eid/soap_note/:sid with another patient's sid to overwrite that clinical note and reassign its pid.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Open-emr Openemr

Products

Openemr Openemr

CVE-2026-124460

OpenEMR before 8.3.0 IDOR in Patient Portal PortalPatientController

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in PortalPatientController::Read() that allows authenticated patients to read other patients' pending demographic change requests. Attackers can supply another patient's ID in the patientId query string parameter to retrieve PHI including names, addresses, SSNs, and insurance information.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-124469

OpenEMR before 8.3.0 SQL Injection via Fee Sheet warehouse parameter

OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Fee Sheet drug-inventory lookup (DrugSalesService::sellDrug) that interpolates the prod[N][warehouse] POST field into an ORDER BY clause. Low-privileged authenticated users can submit Fee Sheet product lines with constant subqueries to run a time-based blind oracle, extracting patient data and users_secure bcrypt hashes.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-124464

OpenEMR before 8.4.0 FHIR Patient Compartment Bypass via QuestionnaireResponse

OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows patient-scoped SMART tokens to read other patients' questionnaire responses because FhirQuestionnaireResponseService does not implement IPatientCompartmentResourceService. Attackers holding a patient/QuestionnaireResponse.rs token can request responses by uuid or list the unfiltered bundle to obtain cross-patient clinical assessment answers.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-124486

OpenEMR before 8.3.0 Missing Authorization in Classic Document Controller

OpenEMR before 8.3.0 contains a missing authorization vulnerability in the classic document controller that allows low-privilege authenticated users to recategorize other patients' documents. Attackers can invoke move_action_process to move a document into a patients|demo category, then retrieve it with an empty patient_id to exfiltrate PHI and tamper with charts.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-124490

OpenEMR before 8.3.0 Arbitrary File Read/Write via oe-module-faxsms disposeDocument

OpenEMR before 8.3.0 contains a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument() method of oe-module-faxsms that allows authenticated attackers to read and write arbitrary files via the file_path parameter. Attackers can use action=download to read credentials and source code, or action=setup with base64 content to write web-executable files for code execution.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-124482

OpenEMR before 8.4.0 Cross-Patient PHI Exfiltration via SMART Patient Launch

OpenEMR before 8.4.0 contains an authorization bypass allowing low-privileged SMART standalone-launch users to bind arbitrary patient UUIDs into the OAuth token context. Attackers with only the patients|demo ACL can select a victim during authorization and read that patient's clinical notes and documents through patient-scoped DocumentReference and Binary FHIR endpoints.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-124478

OpenEMR before 8.3.0 Missing Authorization via addRecall in save.php

OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.php that allows low-privileged authenticated users to modify arbitrary patients' recall data. Attackers can submit a crafted new_pid with recall, contact, provider, facility, and notification preference fields to overwrite records of patients they cannot access.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-124456

OpenEMR before 8.3.0 Missing Authorization and IDOR in Prior-Authorizations Module

OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the oe-module-prior-authorizations module that allow authenticated low-privilege users to access and modify other patients' records. Attackers can request public/reports/list_report.php to view all patients' names, MRNs, insurance and prior-auth data, or submit arbitrary id values to public/index.php to overwrite other patients' prior-authorization records.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-124451

OpenEMR before 8.4.0 Authorization Bypass via checkUserHasAccessToPatient in SMART on FHIR

OpenEMR before 8.4.0 contains an authorization bypass vulnerability in its SMART on FHIR implementation because checkUserHasAccessToPatient() in BearerTokenAuthorizationStrategy.php unconditionally returns true. Authenticated users or malicious SMART apps can manipulate token launch context to bind requests to arbitrary patient UUIDs, gaining unauthorized read/write access to other patients' FHIR resources.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-124447

OpenEMR before 8.3.0 IDOR via OnsitePortalActivityController Update Endpoint

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsitePortalActivityController::Update() that checks the request's patientId instead of the stored record's owner. Authenticated portal patients can send PUT requests to the onsiteportalactivity API with another patient's activity id and their own patientId to disclose tableArgs and checksum data, overwrite narratives and status, and take ownership of the record.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Open-emr Openemr

Products

Openemr Openemr

CVE-2026-102940

OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access to the source document, current patient and category, or destination patient and category before Document::change_patient() performs the mutation. A low-privilege authenticated user can reassign an arbitrary document to a patient or category the user can access and then retrieve it through the normally protected read path. The reassignment occurs before a later list rendering check, so a final HTTP 403 response does not mean the unauthorized write was blocked. This issue is fixed in version 8.4.0.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Open-emr Openemr

Products

Openemr Openemr

CVE-2026-103019

OpenEMR: Unauthenticated Open Redirect via OIDC End Session Endpoint

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, userSessionLogout() in src/RestControllers/AuthorizationController.php uses decodeToken() to process an id_token_hint without verifying its signature and, when the referenced trusted session is absent, redirects to the caller-supplied post_logout_redirect_uri before validating it against the client's registered redirect URIs. An unauthenticated attacker can craft a logout link that sends a user to an arbitrary external site and invalidates the user's session, enabling convincing phishing flows from the legitimate logout endpoint. The endpoint is reachable when the OpenEMR REST API is enabled. This issue is fixed in version 8.3.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Open-emr Openemr

Products

Openemr Openemr

CVE-2026-103020

OpenEMR: Unauthenticated Information Disclosure in admin.php Exposes Database Names and Versions

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the webroot admin.php multisite administration page is enabled without an authentication check, reads database configuration from sqlconf.php, and connects to each configured site database. An unauthenticated network actor can obtain site identifiers, database names, site names, exact OpenEMR versions and patch levels, pending upgrade status, and direct login and patient-portal links. This issue is fixed in version 8.3.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Open-emr Openemr

Products

Openemr Openemr

CVE-2026-103021

OpenEMR: Username Enumeration via Pre-Authentication User Settings Loading

OpenEMR is a free and open source electronic health records and medical practice management application. From 6.0.0 until 8.3.0, interface/globals.php uses the unauthenticated authUser login parameter to populate temp_authuserid and load that account's user_settings before authentication succeeds. Existing usernames can therefore cause an additional database query and may apply visible customized settings, while nonexistent usernames skip that behavior. A remote unauthenticated actor can use timing or page differences to enumerate valid accounts for later credential attacks. This issue is fixed in version 8.3.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Open-emr Openemr

Products

Openemr Openemr

CVE-2026-103935

OpenEMR: Stored XSS via `text()` Misuse in Double-Quoted HTML Attribute

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/forms/transfer_summary/new.php and interface/forms/functional_cognitive_status/new.php render stored transfer_to, code, and codetext values with text(), which uses ENT_NOQUOTES, inside double-quoted HTML value attributes. An authenticated clinical user can store a value containing a double quote that escapes the attribute and injects event-handler markup when another clinician opens the form. Successful exploitation can expose session data and protected health information or permit patient-record actions in the victim's session. This issue is fixed in version 8.3.0.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Open-emr Openemr

Products

Openemr Openemr

CVE-2026-103938

OpenEMR: CSRF Protection Bypass on IPPF Point-of-Sale Void and Regen Operations

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/patient_file/pos_checkout_ippf.php performs state-changing void, voidall, and regen operations through GET requests without CSRF token validation. The form_checksum integrity check is conditional and is skipped when the parameter is omitted, allowing a cross-site request to force an authenticated billing user to void checkouts or regenerate invoice counters. The resulting changes can alter ledger state, financial reporting, and audit records. This issue is fixed in version 8.3.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Open-emr Openemr

Products

Openemr Openemr

CVE-2026-103939

OpenEMR: Weno `file_download.php`: missing ACL/CSRF truncates the e-prescribing pharmacy directory

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/modules/custom_modules/oe-module-weno/scripts/file_download.php has no ACL or CSRF check and ignores the result of validateAdminCredentials(). When the Weno module is enabled, the default GET path calls PharmacyService::removeWenoPharmacies() before attempting a refetch, allowing any authenticated user to truncate the weno_pharmacy table and allowing a cross-site request to trigger the same operation through a logged-in victim. A failed later download can leave the e-prescribing pharmacy directory empty and unavailable. This issue is fixed in version 8.3.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Open-emr Openemr

Products

Openemr Openemr

CVE-2026-104133

OpenEMR: Missing authorization in DORN `compendium_install.php` — non-admin destructive lab-compendium reinstall

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/modules/custom_modules/oe-module-dorn/public/compendium_install.php checks authentication and CSRF but does not require the admin/users ACL enforced by sibling DORN administration scripts. When the DORN module is enabled, a low-privilege authenticated user can supply a labGuid that causes LabCompendiumInstall::uninstall() to delete detail and result procedure types and deactivate order types before the reinstall step. The action can corrupt lab-ordering configuration and require an administrator to restore the compendium. This issue is fixed in version 8.3.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Open-emr Openemr

Products

Openemr Openemr

CVE-2026-104134

OpenEMR: Missing authorization in person-search AJAX leaks patient demographics (name, DOB, phone, email)

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the search_persons action in library/ajax/person_search_ajax.php validates CSRF but does not perform an AclMain authorization check before searching the person and patient_data tables. A low-privilege authenticated user can iterate name prefixes and receive patient first and last names, dates of birth, gender, phone numbers, and email addresses in JSON responses. This issue is fixed in version 8.3.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Open-emr Openemr

Products

Openemr Openemr