---
id: "CVE-2026-124447"
page: "https://infrastack.ai/live/CVE-2026-124447"
kind: "vulnerability"
aliases: ["CVE-2026-124447"]
title: "OpenEMR: patient portal users can overwrite other patients' records"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["healthcare", "openemr", "patient-portal", "runtime", "self-hosted"]
not_affected_if: ["openemr-8.3.0-or-later", "portal-disabled"]
published_at: "2026-11-08T14:18:11+00:00"
first_seen_at: "2026-11-08T14:48:39+00:00"
updated_at: "2026-11-08T14:49:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124447", "first_seen_at": "2026-11-08T14:48:39+00:00"}]
exploit_sources: []
---

# OpenEMR: patient portal users can overwrite other patients' records

Link for people: https://infrastack.ai/live/CVE-2026-124447 (this .md is for agents)

OpenEMR before 8.3.0 checks the wrong patient ID when updating portal activity records, so an authenticated patient can send a PUT request with another patient's activity ID. The attacker can read checksum and table data, overwrite narratives and status, and take ownership of that record.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenEMR version in use; versions below `8.3.0` are affected.
- Confirm whether patient portal access is enabled for patients.

## Fix

- OpenEMR: move to `8.3.0` or later.

## Timeline

- 2026-11-08T14:48:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124447

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openemr/openemr/security/advisories/GHSA-5hx3-92fw-6jm6
- [advisory] Vendor advisory: github.com https://github.com/openemr/openemr/security/advisories/GHSA-x8rm-m66w-qhh5
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openemr-before-8.3.0-idor-via-onsiteportalactivitycontroller-update-endpoint

## From the sources

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsitePortalActivityController::Update() that checks the request's patientId instead of the stored record's owner. Authenticated portal patients can send PUT requests to the onsiteportalactivity API with another patient's activity id and their own patientId to disclose tableArgs and checksum data, overwrite narratives and status, and take ownership of the record.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_