{"id":"CVE-2026-124456","kind":"vulnerability","aliases":["CVE-2026-124456"],"related":[],"title":"OpenEMR: prior-authorization module lets patients' records be read and changed","description":"OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the oe-module-prior-authorizations module that allow authenticated low-privilege users to access and modify other patients' records. Attackers can request public/reports/list_report.php to view all patients' names, MRNs, insurance and prior-auth data, or submit arbitrary id values to public/index.php to overwrite other patients' prior-authorization records.","summary":"OpenEMR before 8.3.0 has missing authorization checks in its prior-authorizations module, so a logged-in low-privilege user can read all patients' names, medical record numbers, insurance and prior-auth data. The same flaw lets such a user overwrite other patients' prior-authorization records by submitting arbitrary ids.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","php","runtime","self-hosted"],"not_affected_if":["managed-hosting","module-not-installed"],"how_to_check":"- Check the installed OpenEMR version and confirm it is below `8.3.0`.\n- Check whether the `oe-module-prior-authorizations` module is installed and enabled.\n- Look for access to `public/reports/list_report.php` and `public/index.php` in web server logs from low-privilege accounts.","fix":"- Upgrade OpenEMR to `8.3.0` or later.","status":"open","published_at":"2026-11-08T14:18:13+00:00","first_seen_at":"2026-11-08T14:48:39+00:00","triaged_at":"2026-11-08T14:49:45+00:00","updated_at":"2026-11-08T14:49:45+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-08T14:49:45Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenEMR to `8.3.0` or later.","reach":"network","title":"OpenEMR: prior-authorization module lets patients' records be read and changed","impact":"high","summary":"OpenEMR before 8.3.0 has missing authorization checks in its prior-authorizations module, so a logged-in low-privilege user can read all patients' names, medical record numbers, insurance and prior-auth data. The same flaw lets such a user overwrite other patients' prior-authorization records by submitting arbitrary ids.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","php"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads and overwrites other patients' medical and insurance records","analyst_note":"","how_to_check":"- Check the installed OpenEMR version and confirm it is below `8.3.0`.\n- Check whether the `oe-module-prior-authorizations` module is installed and enabled.\n- Look for access to `public/reports/list_report.php` and `public/index.php` in web server logs from low-privilege accounts.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["module-not-installed","managed-hosting"],"who_is_affected":"Clinics and organisations that run OpenEMR with the prior-authorizations module enabled are exposed, since any authenticated user with low privileges can reach other patients' data. Installations without that module, or with only fully trusted staff accounts, face less exposure but should still upgrade.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000754,"input_tokens":4643,"output_tokens":580,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124456':15A,18A '-2026':14A,17A '8.3.0':28B,82C 'access':108C 'allow':101C 'arbitrari':78B,132C 'attack':114C 'auth':60B,128C 'authent':102C 'author':4A,31B,37B,74B,85C,98C,143C 'chang':12A 'check':32B 'contain':83C 'cve':13A,16A 'data':61B,129C 'direct':88C 'flaw':64B 'healthcar':19B 'host':25B 'id':79B,133C 'insecur':87C 'insur':56B,124C 'let':6A,65B 'log':42B 'logged-in':41B 'low':45B,104C 'low-privileg':44B,103C 'medic':53B 'miss':30B,84C 'modifi':110C 'modul':5A,38B,96C,99C 'mrns':123C 'name':52B,122C 'number':55B 'object':89C 'oe':95C 'oe-module-prior-author':94C 'openemr':1A,20B,26B,80C 'overwrit':69B,138C 'patient':7A,51B,71B,112C,121C,140C 'php':21B 'prior':3A,36B,59B,73B,97C,127C,142C 'prior-auth':58B,126C 'prior-author':2A,35B,72B,141C 'privileg':46B,105C 'public/index.php':136C 'public/reports/list_report.php':117C 'read':10A,49B 'record':8A,54B,75B,113C,144C 'refer':90C 'request':116C 'runtim':22B 'self':24B 'self-host':23B 'submit':77B,131C 'user':47B,68B,106C 'valu':134C 'view':119C 'vulner':91C","nicknames":[],"mitigations":[],"who_affected":"Clinics and organisations that run OpenEMR with the prior-authorizations module enabled are exposed, since any authenticated user with low privileges can reach other patients' data. Installations without that module, or with only fully trusted staff accounts, face less exposure but should still upgrade.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","php","runtime","selfhosted"],"campaign_type":null,"search_a":"'-124456':15A,18A '-2026':14A,17A 'author':4A 'chang':12A 'cve':13A,16A 'let':6A 'modul':5A 'openemr':1A 'patient':7A 'prior':3A 'prior-author':2A 'read':10A 'record':8A","search_b":"'8.3.0':28B 'arbitrari':78B 'auth':60B 'author':31B,37B,74B 'check':32B 'data':61B 'flaw':64B 'healthcar':19B 'host':25B 'id':79B 'insur':56B 'let':65B 'log':42B 'logged-in':41B 'low':45B 'low-privileg':44B 'medic':53B 'miss':30B 'modul':38B 'name':52B 'number':55B 'openemr':20B,26B 'overwrit':69B 'patient':51B,71B 'php':21B 'prior':36B,59B,73B 'prior-auth':58B 'prior-author':35B,72B 'privileg':46B 'read':49B 'record':54B,75B 'runtim':22B 'self':24B 'self-host':23B 'submit':77B 'user':47B,68B","search_c":"'8.3.0':82C 'access':108C 'allow':101C 'arbitrari':132C 'attack':114C 'auth':128C 'authent':102C 'author':85C,98C,143C 'contain':83C 'data':129C 'direct':88C 'id':133C 'insecur':87C 'insur':124C 'low':104C 'low-privileg':103C 'miss':84C 'modifi':110C 'modul':96C,99C 'mrns':123C 'name':122C 'object':89C 'oe':95C 'oe-module-prior-author':94C 'openemr':80C 'overwrit':138C 'patient':112C,121C,140C 'prior':97C,127C,142C 'prior-auth':126C 'prior-author':141C 'privileg':105C 'public/index.php':136C 'public/reports/list_report.php':117C 'record':113C,144C 'refer':90C 'request':116C 'submit':131C 'user':106C 'valu':134C 'view':119C 'vulner':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-08-18T09:04:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124456","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124456","severity":null,"published_at":"2026-11-08T14:18:13+00:00","modified_at":"2026-11-08T14:18:13+00:00","first_seen_at":"2026-11-08T14:48:39+00:00","fetched_at":"2026-11-08T14:48:39+00:00","note":null}],"documents":[{"id":102095,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-9cgf-m88m-9cvx","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-18T09:04:10+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102096,"url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-missing-authorization-and-idor-in-prior-authorizations-module","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}