{"id":"CVE-2026-124455","kind":"vulnerability","aliases":["CVE-2026-124455"],"related":[],"title":"OpenEMR: portal patients can read other patients' documents and PHI","description":"OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query() that allows authenticated portal patients to read other patients' documents by overriding Pid_Equals criteria. Attackers can supply Pid_Equals, Pid_GreaterThan, or Pid_In request parameters to the onsitedocuments API to retrieve signed consent forms, signatures, and PHI of any patient.","summary":"OpenEMR's onsitedocuments API lets an authenticated portal patient override the patient ID filter and retrieve other patients' signed consent forms, signatures and health information. An attacker gets any patient's protected health information by changing request parameters.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","package","patient-portal","self-hosted"],"not_affected_if":["openemr-8.3.0-or-later","portal-disabled"],"how_to_check":"- Check the OpenEMR version in the installation; affected versions are those before `8.3.0`\n- Confirm whether the patient portal is enabled and reachable from the internet","fix":"- OpenEMR: move to `8.3.0` or later","status":"open","published_at":"2026-11-08T14:18:12+00:00","first_seen_at":"2026-11-08T14:48:39+00:00","triaged_at":"2026-11-08T14:49:46+00:00","updated_at":"2026-11-08T14:49:47+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T14:49:46Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.3.0` or later","reach":"internet","title":"OpenEMR: portal patients can read other patients' documents and PHI","impact":"high","summary":"OpenEMR's onsitedocuments API lets an authenticated portal patient override the patient ID filter and retrieve other patients' signed consent forms, signatures and health information. An attacker gets any patient's protected health information by changing request parameters.","audience":"businesses","category":"package","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","patient-portal"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Any patient's consent forms, signatures and PHI are readable by portal users","analyst_note":"","how_to_check":"- Check the OpenEMR version in the installation; affected versions are those before `8.3.0`\n- Confirm whether the patient portal is enabled and reachable from the internet","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["openemr-8.3.0-or-later","portal-disabled"],"who_is_affected":"Any OpenEMR deployment before 8.3.0 with the patient portal enabled is exposed, since portal patients hold valid accounts. Installations without the patient portal, or with it restricted, are less exposed. unknown whether other configurations are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000718,"input_tokens":4650,"output_tokens":506,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124455':13A,16A '-2026':12A,15A '8.3.0':66C 'allow':78C 'api':29B,107C 'attack':52B,92C 'authent':32B,79C 'chang':61B 'consent':45B,111C 'contain':67C 'criteria':91C 'cve':11A,14A 'direct':70C 'document':8A,86C 'equal':90C,96C 'filter':39B 'form':46B,112C 'get':53B 'greaterthan':98C 'health':49B,58B 'healthcar':17B 'host':25B 'id':38B 'inform':50B,59B 'insecur':69C 'let':30B 'object':71C 'onsitedocu':28B,106C 'onsitedocumentcontrol':75C 'openemr':1A,18B,26B,64C 'overrid':35B,88C 'packag':19B 'paramet':63B,103C 'patient':3A,7A,21B,34B,37B,43B,55B,81C,85C,118C 'patient-port':20B 'phi':10A,115C 'pid':89C,95C,97C,100C 'portal':2A,22B,33B,80C 'protect':57B 'queri':76C 'read':5A,83C 'refer':72C 'request':62B,102C 'retriev':41B,109C 'self':24B 'self-host':23B 'sign':44B,110C 'signatur':47B,113C 'suppli':94C 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"Any OpenEMR deployment before 8.3.0 with the patient portal enabled is exposed, since portal patients hold valid accounts. Installations without the patient portal, or with it restricted, are less exposed. unknown whether other configurations are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","package","patientportal","selfhosted"],"campaign_type":null,"search_a":"'-124455':13A,16A '-2026':12A,15A 'cve':11A,14A 'document':8A 'openemr':1A 'patient':3A,7A 'phi':10A 'portal':2A 'read':5A","search_b":"'api':29B 'attack':52B 'authent':32B 'chang':61B 'consent':45B 'filter':39B 'form':46B 'get':53B 'health':49B,58B 'healthcar':17B 'host':25B 'id':38B 'inform':50B,59B 'let':30B 'onsitedocu':28B 'openemr':18B,26B 'overrid':35B 'packag':19B 'paramet':63B 'patient':21B,34B,37B,43B,55B 'patient-port':20B 'portal':22B,33B 'protect':57B 'request':62B 'retriev':41B 'self':24B 'self-host':23B 'sign':44B 'signatur':47B","search_c":"'8.3.0':66C 'allow':78C 'api':107C 'attack':92C 'authent':79C 'consent':111C 'contain':67C 'criteria':91C 'direct':70C 'document':86C 'equal':90C,96C 'form':112C 'greaterthan':98C 'insecur':69C 'object':71C 'onsitedocu':106C 'onsitedocumentcontrol':75C 'openemr':64C 'overrid':88C 'paramet':103C 'patient':81C,85C,118C 'phi':115C 'pid':89C,95C,97C,100C 'portal':80C 'queri':76C 'read':83C 'refer':72C 'request':102C 'retriev':109C 'sign':110C 'signatur':113C 'suppli':94C 'vulner':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-08-18T09:08:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124455","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124455","severity":null,"published_at":"2026-11-08T14:18:12+00:00","modified_at":"2026-11-08T14:18:12+00:00","first_seen_at":"2026-11-08T14:48:39+00:00","fetched_at":"2026-11-08T14:48:39+00:00","note":null}],"documents":[{"id":102093,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-hvp7-q2hp-6j6g","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-18T09:08:00+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102094,"url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-idor-via-portal-onsitedocument-pid-equals-mass-assignment","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}