CVE-2026-124460 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.3.0 has an insecure direct object reference in PortalPatientController::Read(). A logged-in patient who changes the patientId query parameter can read other patients' pending demographic change requests, including names, addresses, SSNs and insurance data.
first public Aug 18, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Healthcare organizations running OpenEMR with the patient portal enabled are exposed, since any authenticated patient account can request other patients' IDs. Installations without the patient portal, or with patient accounts restricted, are less exposed. The sources do not say more about configuration.
Not affected if openemr-8.3.0-or-later, patient-portal-disabled
Who cares healthcare, openemr, patient-portal, phi
8.3.0 are affected per the sources.8.3.0 or later, per the sources.OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in PortalPatientController::Read() that allows authenticated patients to read other patients' pending demographic change requests. Attackers can supply another patient's ID in the patientId query string parameter to retrieve PHI including names, addresses, SSNs, and insurance information.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.