---
id: "CVE-2026-124444"
page: "https://infrastack.ai/live/CVE-2026-124444"
kind: "vulnerability"
aliases: ["CVE-2026-124444"]
title: "OpenEMR: patient portal API lets logged-in patients read any database table"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["healthcare", "openemr", "other", "patient-portal", "self-hosted"]
not_affected_if: ["no-portal-accounts", "patient-portal-disabled"]
published_at: "2026-11-08T14:18:11+00:00"
first_seen_at: "2026-11-08T14:48:39+00:00"
updated_at: "2026-11-08T14:49:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124444", "first_seen_at": "2026-11-08T14:48:39+00:00"}]
exploit_sources: []
---

# OpenEMR: patient portal API lets logged-in patients read any database table

Link for people: https://infrastack.ai/live/CVE-2026-124444 (this .md is for agents)

OpenEMR before 8.4.0 has a mass assignment flaw in the patient portal OnsiteDocument query API, where request parameters such as Id_BitwiseAnd are placed unquoted into an SQL WHERE clause. An authenticated patient portal user can inject SQL to read any database table, including other patients' records and staff password hashes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenEMR version in the installed application, for example `8.3.x` or lower means affected.
- Confirm whether the patient portal is enabled and reachable by patients.

## Fix

- OpenEMR: move to `8.4.0` or later.

## Timeline

- 2026-11-08T14:48:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124444

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openemr/openemr/security/advisories/GHSA-hx8r-g8gw-6g2j
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openemr-before-8.4.0-sql-injection-via-onsitedocument-query-api

## From the sources

OpenEMR before 8.4.0 contains a mass assignment vulnerability in the patient portal OnsiteDocument query API that lets request parameters set bitwise criteria filters whose values are placed unquoted into the SQL WHERE clause. Authenticated patient portal users can inject SQL via parameters such as Id_BitwiseAnd to read any database table, including other patients' records and staff password hashes.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_