---
id: "CVE-2026-124460"
page: "https://infrastack.ai/live/CVE-2026-124460"
kind: "vulnerability"
aliases: ["CVE-2026-124460"]
title: "OpenEMR: patients can read other patients' pending demographic changes"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["healthcare", "openemr", "other", "patient-portal", "phi"]
not_affected_if: ["openemr-8.3.0-or-later", "patient-portal-disabled"]
published_at: "2026-11-08T14:18:13+00:00"
first_seen_at: "2026-11-08T14:48:40+00:00"
updated_at: "2026-11-08T14:49:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124460", "first_seen_at": "2026-11-08T14:48:40+00:00"}]
exploit_sources: []
---

# OpenEMR: patients can read other patients' pending demographic changes

Link for people: https://infrastack.ai/live/CVE-2026-124460 (this .md is for agents)

OpenEMR before 8.3.0 has an insecure direct object reference in PortalPatientController::Read(). A logged-in patient who changes the patientId query parameter can read other patients' pending demographic change requests, including names, addresses, SSNs and insurance data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenEMR version in use; versions before `8.3.0` are affected per the sources.
- Review whether the patient portal is enabled and reachable by patients.

## Fix

- OpenEMR: move to `8.3.0` or later, per the sources.

## Timeline

- 2026-11-08T14:48:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124460

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openemr/openemr/security/advisories/GHSA-rw79-jfg7-fgpm
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openemr-before-8.3.0-idor-in-patient-portal-portalpatientcontroller

## From the sources

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in PortalPatientController::Read() that allows authenticated patients to read other patients' pending demographic change requests. Attackers can supply another patient's ID in the patientId query string parameter to retrieve PHI including names, addresses, SSNs, and insurance information.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_