CVE-2026-124461 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.3.0 lets any authenticated user supply an arbitrary doc_id to library/ajax/upload.php and read or overwrite that document. Low-privilege users can enumerate document IDs to expose patient health information and alter medical records across all patients.
first public Aug 18, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any deployment of OpenEMR before 8.3.0 with user accounts, including low-privilege staff accounts, is exposed. The sources do not say whether non-default configuration is required, so treat all versions before 8.3.0 as affected.
Not affected if openemr-8.3.0-or-later
Who cares healthcare, openemr, php, self-hosted
8.3.0 are in scope.library/ajax/upload.php in your web server logs for fetch and save requests with varying doc_id values.8.3.0 or later.OpenEMR before 8.3.0 contains a missing authorization vulnerability in library/ajax/upload.php that allows any authenticated user to read and overwrite document data by supplying an arbitrary doc_id. Low-privilege users can enumerate doc_id values with the fetch and save actions to disclose patient health information and tamper with medical records across all patients.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.