CVE-2026-124447 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.3.0 checks the wrong patient ID when updating portal activity records, so an authenticated patient can send a PUT request with another patient's activity ID. The attacker can read checksum and table data, overwrite narratives and status, and take ownership of that record.
first public Aug 18, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Clinics and hospitals running self-hosted OpenEMR with the patient portal enabled are exposed, since the flaw is in the onsite portal activity API that portal patients can reach. Installations without the portal, or where patients cannot log in, are not exposed through this path.
Not affected if openemr-8.3.0-or-later, portal-disabled
Who cares healthcare, openemr, patient-portal, self-hosted
8.3.0 are affected.8.3.0 or later.OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsitePortalActivityController::Update() that checks the request's patientId instead of the stored record's owner. Authenticated portal patients can send PUT requests to the onsiteportalactivity API with another patient's activity id and their own patientId to disclose tableArgs and checksum data, overwrite narratives and status, and take ownership of the record.
This page as .md ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.