---
id: "CVE-2026-124455"
page: "https://infrastack.ai/live/CVE-2026-124455"
kind: "vulnerability"
aliases: ["CVE-2026-124455"]
title: "OpenEMR: portal patients can read other patients' documents and PHI"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["healthcare", "openemr", "package", "patient-portal", "self-hosted"]
not_affected_if: ["openemr-8.3.0-or-later", "portal-disabled"]
published_at: "2026-11-08T14:18:12+00:00"
first_seen_at: "2026-11-08T14:48:39+00:00"
updated_at: "2026-11-08T14:49:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124455", "first_seen_at": "2026-11-08T14:48:39+00:00"}]
exploit_sources: []
---

# OpenEMR: portal patients can read other patients' documents and PHI

Link for people: https://infrastack.ai/live/CVE-2026-124455 (this .md is for agents)

OpenEMR's onsitedocuments API lets an authenticated portal patient override the patient ID filter and retrieve other patients' signed consent forms, signatures and health information. An attacker gets any patient's protected health information by changing request parameters.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenEMR version in the installation; affected versions are those before `8.3.0`
- Confirm whether the patient portal is enabled and reachable from the internet

## Fix

- OpenEMR: move to `8.3.0` or later

## Timeline

- 2026-11-08T14:48:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124455

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openemr/openemr/security/advisories/GHSA-hvp7-q2hp-6j6g
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openemr-before-8.3.0-idor-via-portal-onsitedocument-pid-equals-mass-assignment

## From the sources

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query() that allows authenticated portal patients to read other patients' documents by overriding Pid_Equals criteria. Attackers can supply Pid_Equals, Pid_GreaterThan, or Pid_In request parameters to the onsitedocuments API to retrieve signed consent forms, signatures, and PHI of any patient.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_