CVE-2026-124459 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.3.0 has encounter-form view and save endpoints that do not check patient or encounter ownership. An authenticated clinical user can change sequential form IDs in requests such as soap/view.php and save.php to read and overwrite other patients' clinical records.
first public Aug 18, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any OpenEMR deployment before 8.3.0 where logged-in clinical users can access encounter forms. The flaw is in the view and save endpoints, so exposure depends on which accounts can log in and reach them. Deployments with no multi-user clinical access have a much smaller exposure.
Not affected if openemr-8.3.0-or-later, single-user-deployment
Who cares healthcare, openemr, self-hosted
8.3.0 or later (per the advisory range 'before 8.3.0')OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in many encounter-form view and save endpoints that lack patient/encounter ownership checks. Authenticated clinical users can enumerate sequential form id values in requests such as soap/view.php and save.php to read and overwrite other patients' clinical records.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.