CVE-2026-124456 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.3.0 has missing authorization checks in its prior-authorizations module, so a logged-in low-privilege user can read all patients' names, medical record numbers, insurance and prior-auth data. The same flaw lets such a user overwrite other patients' prior-authorization records by submitting arbitrary ids.
first public Aug 18, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Clinics and organisations that run OpenEMR with the prior-authorizations module enabled are exposed, since any authenticated user with low privileges can reach other patients' data. Installations without that module, or with only fully trusted staff accounts, face less exposure but should still upgrade.
Not affected if managed-hosting, module-not-installed
Who cares healthcare, openemr, php, self-hosted
8.3.0.oe-module-prior-authorizations module is installed and enabled.public/reports/list_report.php and public/index.php in web server logs from low-privilege accounts.8.3.0 or later.OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the oe-module-prior-authorizations module that allow authenticated low-privilege users to access and modify other patients' records. Attackers can request public/reports/list_report.php to view all patients' names, MRNs, insurance and prior-auth data, or submit arbitrary id values to public/index.php to overwrite other patients' prior-authorization records.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.