CVE-2026-124444 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.4.0 has a mass assignment flaw in the patient portal OnsiteDocument query API, where request parameters such as Id_BitwiseAnd are placed unquoted into an SQL WHERE clause. An authenticated patient portal user can inject SQL to read any database table, including other patients' records and staff password hashes.
first public Sep 13, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Healthcare organizations running OpenEMR with the patient portal enabled are exposed, since any authenticated patient portal user can reach the vulnerable query API. Installations with the patient portal disabled or without patient portal accounts are not reachable through this path. Staff and administrators should check whether patient portal accounts are open to outside users.
Not affected if no-portal-accounts, patient-portal-disabled
Who cares healthcare, openemr, patient-portal, self-hosted
8.3.x or lower means affected.8.4.0 or later.OpenEMR before 8.4.0 contains a mass assignment vulnerability in the patient portal OnsiteDocument query API that lets request parameters set bitwise criteria filters whose values are placed unquoted into the SQL WHERE clause. Authenticated patient portal users can inject SQL via parameters such as Id_BitwiseAnd to read any database table, including other patients' records and staff password hashes.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.