{"id":"CVE-2026-124447","kind":"vulnerability","aliases":["CVE-2026-124447"],"related":[],"title":"OpenEMR: patient portal users can overwrite other patients' records","description":"OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsitePortalActivityController::Update() that checks the request's patientId instead of the stored record's owner. Authenticated portal patients can send PUT requests to the onsiteportalactivity API with another patient's activity id and their own patientId to disclose tableArgs and checksum data, overwrite narratives and status, and take ownership of the record.","summary":"OpenEMR before 8.3.0 checks the wrong patient ID when updating portal activity records, so an authenticated patient can send a PUT request with another patient's activity ID. The attacker can read checksum and table data, overwrite narratives and status, and take ownership of that record.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","patient-portal","runtime","self-hosted"],"not_affected_if":["openemr-8.3.0-or-later","portal-disabled"],"how_to_check":"- Check the OpenEMR version in use; versions below `8.3.0` are affected.\n- Confirm whether patient portal access is enabled for patients.","fix":"- OpenEMR: move to `8.3.0` or later.","status":"open","published_at":"2026-11-08T14:18:11+00:00","first_seen_at":"2026-11-08T14:48:39+00:00","triaged_at":"2026-11-08T14:49:16+00:00","updated_at":"2026-11-08T14:49:16+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-08T14:49:16Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.3.0` or later.","reach":"internet","title":"OpenEMR: patient portal users can overwrite other patients' records","impact":"high","summary":"OpenEMR before 8.3.0 checks the wrong patient ID when updating portal activity records, so an authenticated patient can send a PUT request with another patient's activity ID. The attacker can read checksum and table data, overwrite narratives and status, and take ownership of that record.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","patient-portal"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads and overwrites other patients' clinical records.","analyst_note":"","how_to_check":"- Check the OpenEMR version in use; versions below `8.3.0` are affected.\n- Confirm whether patient portal access is enabled for patients.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["portal-disabled","openemr-8.3.0-or-later"],"who_is_affected":"Clinics and hospitals running self-hosted OpenEMR with the patient portal enabled are exposed, since the flaw is in the onsite portal activity API that portal patients can reach. Installations without the portal, or where patients cannot log in, are not exposed through this path.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000721,"input_tokens":4646,"output_tokens":512,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124447':12A,15A '-2026':11A,14A '8.3.0':27B,73C 'activ':36B,51B,112C 'anoth':48B,109C 'api':107C 'attack':54B 'authent':40B,97C 'check':28B,85C 'checksum':57B,122C 'contain':74C 'cve':10A,13A 'data':60B,123C 'direct':77C 'disclos':119C 'healthcar':16B 'host':24B 'id':32B,52B,113C 'insecur':76C 'instead':90C 'narrat':62B,125C 'object':78C 'onsiteportalact':106C 'onsiteportalactivitycontrol':82C 'openemr':1A,17B,25B,71C 'overwrit':6A,61B,124C 'owner':96C 'ownership':67B,130C 'patient':2A,8A,19B,31B,41B,49B,99C,110C 'patient-port':18B 'patientid':89C,117C 'portal':3A,20B,35B,98C 'put':45B,102C 'read':56B 'record':9A,37B,70B,94C,133C 'refer':79C 'request':46B,87C,103C 'runtim':21B 'self':23B 'self-host':22B 'send':43B,101C 'status':64B,127C 'store':93C 'tabl':59B 'tablearg':120C 'take':66B,129C 'updat':34B,83C 'user':4A 'vulner':80C 'wrong':30B","nicknames":[],"mitigations":[],"who_affected":"Clinics and hospitals running self-hosted OpenEMR with the patient portal enabled are exposed, since the flaw is in the onsite portal activity API that portal patients can reach. Installations without the portal, or where patients cannot log in, are not exposed through this path.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","patientportal","runtime","selfhosted"],"campaign_type":null,"search_a":"'-124447':12A,15A '-2026':11A,14A 'cve':10A,13A 'openemr':1A 'overwrit':6A 'patient':2A,8A 'portal':3A 'record':9A 'user':4A","search_b":"'8.3.0':27B 'activ':36B,51B 'anoth':48B 'attack':54B 'authent':40B 'check':28B 'checksum':57B 'data':60B 'healthcar':16B 'host':24B 'id':32B,52B 'narrat':62B 'openemr':17B,25B 'overwrit':61B 'ownership':67B 'patient':19B,31B,41B,49B 'patient-port':18B 'portal':20B,35B 'put':45B 'read':56B 'record':37B,70B 'request':46B 'runtim':21B 'self':23B 'self-host':22B 'send':43B 'status':64B 'tabl':59B 'take':66B 'updat':34B 'wrong':30B","search_c":"'8.3.0':73C 'activ':112C 'anoth':109C 'api':107C 'authent':97C 'check':85C 'checksum':122C 'contain':74C 'data':123C 'direct':77C 'disclos':119C 'id':113C 'insecur':76C 'instead':90C 'narrat':125C 'object':78C 'onsiteportalact':106C 'onsiteportalactivitycontrol':82C 'openemr':71C 'overwrit':124C 'owner':96C 'ownership':130C 'patient':99C,110C 'patientid':89C,117C 'portal':98C 'put':102C 'record':94C,133C 'refer':79C 'request':87C,103C 'send':101C 'status':127C 'store':93C 'tablearg':120C 'take':129C 'updat':83C 'vulner':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-08-18T09:12:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124447","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124447","severity":null,"published_at":"2026-11-08T14:18:11+00:00","modified_at":"2026-11-08T14:18:11+00:00","first_seen_at":"2026-11-08T14:48:39+00:00","fetched_at":"2026-11-08T14:48:39+00:00","note":null}],"documents":[{"id":102078,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-5hx3-92fw-6jm6","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-18T09:12:50+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102079,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-x8rm-m66w-qhh5","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-18T09:13:19+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102080,"url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-idor-via-onsiteportalactivitycontroller-update-endpoint","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}