CVE-2026-124455 · Package
NO FIX YET · SEE WHAT TO DO
OpenEMR's onsitedocuments API lets an authenticated portal patient override the patient ID filter and retrieve other patients' signed consent forms, signatures and health information. An attacker gets any patient's protected health information by changing request parameters.
first public Aug 18, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any OpenEMR deployment before 8.3.0 with the patient portal enabled is exposed, since portal patients hold valid accounts. Installations without the patient portal, or with it restricted, are less exposed. unknown whether other configurations are affected.
Not affected if openemr-8.3.0-or-later, portal-disabled
Who cares healthcare, openemr, patient-portal, self-hosted
8.3.08.3.0 or laterOpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query() that allows authenticated portal patients to read other patients' documents by overriding Pid_Equals criteria. Attackers can supply Pid_Equals, Pid_GreaterThan, or Pid_In request parameters to the onsitedocuments API to retrieve signed consent forms, signatures, and PHI of any patient.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.