{"id":"CVE-2026-124460","kind":"vulnerability","aliases":["CVE-2026-124460"],"related":[],"title":"OpenEMR: patients can read other patients' pending demographic changes","description":"OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in PortalPatientController::Read() that allows authenticated patients to read other patients' pending demographic change requests. Attackers can supply another patient's ID in the patientId query string parameter to retrieve PHI including names, addresses, SSNs, and insurance information.","summary":"OpenEMR before 8.3.0 has an insecure direct object reference in PortalPatientController::Read(). A logged-in patient who changes the patientId query parameter can read other patients' pending demographic change requests, including names, addresses, SSNs and insurance data.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","other","patient-portal","phi"],"not_affected_if":["openemr-8.3.0-or-later","patient-portal-disabled"],"how_to_check":"- Check the OpenEMR version in use; versions before `8.3.0` are affected per the sources.\n- Review whether the patient portal is enabled and reachable by patients.","fix":"- OpenEMR: move to `8.3.0` or later, per the sources.","status":"open","published_at":"2026-11-08T14:18:13+00:00","first_seen_at":"2026-11-08T14:48:40+00:00","triaged_at":"2026-11-08T14:49:43+00:00","updated_at":"2026-11-08T14:49:43+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-08T14:49:43Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.3.0` or later, per the sources.","reach":"internet","title":"OpenEMR: patients can read other patients' pending demographic changes","impact":"high","summary":"OpenEMR before 8.3.0 has an insecure direct object reference in PortalPatientController::Read(). A logged-in patient who changes the patientId query parameter can read other patients' pending demographic change requests, including names, addresses, SSNs and insurance data.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","healthcare","patient-portal","phi"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"patients read other patients' PHI, including SSNs and insurance data","analyst_note":"","how_to_check":"- Check the OpenEMR version in use; versions before `8.3.0` are affected per the sources.\n- Review whether the patient portal is enabled and reachable by patients.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patient-portal-disabled","openemr-8.3.0-or-later"],"who_is_affected":"Healthcare organizations running OpenEMR with the patient portal enabled are exposed, since any authenticated patient account can request other patients' IDs. Installations without the patient portal, or with patient accounts restricted, are less exposed. The sources do not say more about configuration.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000722,"input_tokens":4612,"output_tokens":521,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124460':12A,15A '-2026':11A,14A '8.3.0':25B,63C 'address':56B,104C 'allow':75C 'anoth':89C 'attack':86C 'authent':76C 'chang':9A,41B,52B,84C 'contain':64C 'cve':10A,13A 'data':60B 'demograph':8A,51B,83C 'direct':29B,67C 'healthcar':16B 'id':92C 'includ':54B,102C 'inform':108C 'insecur':28B,66C 'insur':59B,107C 'log':37B 'logged-in':36B 'name':55B,103C 'object':30B,68C 'openemr':1A,17B,23B,61C 'paramet':45B,98C 'patient':2A,6A,20B,39B,49B,77C,81C,90C 'patient-port':19B 'patientid':43B,95C 'pend':7A,50B,82C 'phi':22B,101C 'portal':21B 'portalpatientcontrol':33B,72C 'queri':44B,96C 'read':4A,34B,47B,73C,79C 'refer':31B,69C 'request':53B,85C 'retriev':100C 'ssns':57B,105C 'string':97C 'suppli':88C 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Healthcare organizations running OpenEMR with the patient portal enabled are exposed, since any authenticated patient account can request other patients' IDs. Installations without the patient portal, or with patient accounts restricted, are less exposed. The sources do not say more about configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","other","patientportal","phi"],"campaign_type":null,"search_a":"'-124460':12A,15A '-2026':11A,14A 'chang':9A 'cve':10A,13A 'demograph':8A 'openemr':1A 'patient':2A,6A 'pend':7A 'read':4A","search_b":"'8.3.0':25B 'address':56B 'chang':41B,52B 'data':60B 'demograph':51B 'direct':29B 'healthcar':16B 'includ':54B 'insecur':28B 'insur':59B 'log':37B 'logged-in':36B 'name':55B 'object':30B 'openemr':17B,23B 'paramet':45B 'patient':20B,39B,49B 'patient-port':19B 'patientid':43B 'pend':50B 'phi':22B 'portal':21B 'portalpatientcontrol':33B 'queri':44B 'read':34B,47B 'refer':31B 'request':53B 'ssns':57B","search_c":"'8.3.0':63C 'address':104C 'allow':75C 'anoth':89C 'attack':86C 'authent':76C 'chang':84C 'contain':64C 'demograph':83C 'direct':67C 'id':92C 'includ':102C 'inform':108C 'insecur':66C 'insur':107C 'name':103C 'object':68C 'openemr':61C 'paramet':98C 'patient':77C,81C,90C 'patientid':95C 'pend':82C 'phi':101C 'portalpatientcontrol':72C 'queri':96C 'read':73C,79C 'refer':69C 'request':85C 'retriev':100C 'ssns':105C 'string':97C 'suppli':88C 'vulner':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-08-18T09:11:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124460","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124460","severity":null,"published_at":"2026-11-08T14:18:13+00:00","modified_at":"2026-11-08T14:18:13+00:00","first_seen_at":"2026-11-08T14:48:40+00:00","fetched_at":"2026-11-08T14:48:40+00:00","note":null}],"documents":[{"id":102103,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-rw79-jfg7-fgpm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-18T09:11:35+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102104,"url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-idor-in-patient-portal-portalpatientcontroller","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}