{"id":"CVE-2026-124459","kind":"vulnerability","aliases":["CVE-2026-124459"],"related":[],"title":"OpenEMR: missing ownership checks let users read and overwrite other patients' records","description":"OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in many encounter-form view and save endpoints that lack patient/encounter ownership checks. Authenticated clinical users can enumerate sequential form id values in requests such as soap/view.php and save.php to read and overwrite other patients' clinical records.","summary":"OpenEMR before 8.3.0 has encounter-form view and save endpoints that do not check patient or encounter ownership. An authenticated clinical user can change sequential form IDs in requests such as soap/view.php and save.php to read and overwrite other patients' clinical records.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","runtime","self-hosted"],"not_affected_if":["openemr-8.3.0-or-later","single-user-deployment"],"how_to_check":"- Check the installed OpenEMR version against the fixed version in the product ranges (unknown in sources)\n- Confirm whether clinical users can reach soap/view.php and save.php for patients outside their care","fix":"- OpenEMR: `8.3.0` or later (per the advisory range 'before 8.3.0')","status":"open","published_at":"2026-11-08T14:18:13+00:00","first_seen_at":"2026-11-08T14:48:40+00:00","triaged_at":"2026-11-08T14:49:14+00:00","updated_at":"2026-11-08T14:49:14+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-08T14:49:14Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: `8.3.0` or later (per the advisory range 'before 8.3.0')","reach":"network","title":"OpenEMR: missing ownership checks let users read and overwrite other patients' records","impact":"high","summary":"OpenEMR before 8.3.0 has encounter-form view and save endpoints that do not check patient or encounter ownership. An authenticated clinical user can change sequential form IDs in requests such as soap/view.php and save.php to read and overwrite other patients' clinical records.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","healthcare","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads and overwrites other patients' clinical records","analyst_note":"Confirm the affected version range and fix details from the vendor advisory on github.com and the vulncheck write-up before relying on them.","how_to_check":"- Check the installed OpenEMR version against the fixed version in the product ranges (unknown in sources)\n- Confirm whether clinical users can reach soap/view.php and save.php for patients outside their care","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["openemr-8.3.0-or-later","single-user-deployment"],"who_is_affected":"Any OpenEMR deployment before 8.3.0 where logged-in clinical users can access encounter forms. The flaw is in the view and save endpoints, so exposure depends on which accounts can log in and reach them. Deployments with no multi-user clinical access have a much smaller exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000754,"input_tokens":4605,"output_tokens":587,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124459':15A,18A '-2026':14A,17A '8.3.0':27B,70C 'authent':45B,92C 'chang':49B 'check':4A,39B,91C 'clinic':46B,66B,93C,114C 'contain':71C 'cve':13A,16A 'direct':74C 'encount':30B,42B,81C 'encounter-form':29B,80C 'endpoint':35B,86C 'enumer':96C 'form':31B,51B,82C,98C 'healthcar':19B 'host':24B 'id':52B,99C 'insecur':73C 'lack':88C 'let':5A 'mani':79C 'miss':2A 'object':75C 'openemr':1A,20B,25B,68C 'overwrit':9A,63B,111C 'ownership':3A,43B,90C 'patient':11A,40B,65B,113C 'patient/encounter':89C 'read':7A,61B,109C 'record':12A,67B,115C 'refer':76C 'request':54B,102C 'runtim':21B 'save':34B,85C 'save.php':59B,107C 'self':23B 'self-host':22B 'sequenti':50B,97C 'soap/view.php':57B,105C 'user':6A,47B,94C 'valu':100C 'view':32B,83C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Any OpenEMR deployment before 8.3.0 where logged-in clinical users can access encounter forms. The flaw is in the view and save endpoints, so exposure depends on which accounts can log in and reach them. Deployments with no multi-user clinical access have a much smaller exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","runtime","selfhosted"],"campaign_type":null,"search_a":"'-124459':15A,18A '-2026':14A,17A 'check':4A 'cve':13A,16A 'let':5A 'miss':2A 'openemr':1A 'overwrit':9A 'ownership':3A 'patient':11A 'read':7A 'record':12A 'user':6A","search_b":"'8.3.0':27B 'authent':45B 'chang':49B 'check':39B 'clinic':46B,66B 'encount':30B,42B 'encounter-form':29B 'endpoint':35B 'form':31B,51B 'healthcar':19B 'host':24B 'id':52B 'openemr':20B,25B 'overwrit':63B 'ownership':43B 'patient':40B,65B 'read':61B 'record':67B 'request':54B 'runtim':21B 'save':34B 'save.php':59B 'self':23B 'self-host':22B 'sequenti':50B 'soap/view.php':57B 'user':47B 'view':32B","search_c":"'8.3.0':70C 'authent':92C 'check':91C 'clinic':93C,114C 'contain':71C 'direct':74C 'encount':81C 'encounter-form':80C 'endpoint':86C 'enumer':96C 'form':82C,98C 'id':99C 'insecur':73C 'lack':88C 'mani':79C 'object':75C 'openemr':68C 'overwrit':111C 'ownership':90C 'patient':113C 'patient/encounter':89C 'read':109C 'record':115C 'refer':76C 'request':102C 'save':85C 'save.php':107C 'sequenti':97C 'soap/view.php':105C 'user':94C 'valu':100C 'view':83C 'vulner':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-08-18T08:59:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124459","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124459","severity":null,"published_at":"2026-11-08T14:18:13+00:00","modified_at":"2026-11-08T14:18:13+00:00","first_seen_at":"2026-11-08T14:48:40+00:00","fetched_at":"2026-11-08T14:48:40+00:00","note":null}],"documents":[{"id":102101,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-3mg9-27fw-m9j6","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-18T08:59:04+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102102,"url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-cross-patient-idor-via-encounter-form-viewers-and-save-handlers","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}