CVE-2026-124462 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.3.0 has an authorization check that only looks at a lowercase pid parameter, so a logged-in patient portal user can send a capitalised Pid and load another patient's onsite documents. An attacker gets protected health information (PHI) belonging to other patients.
first public Aug 18, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Clinics and organisations running OpenEMR with the patient portal enabled are exposed, because authenticated patients can reach the onsite documents endpoint. Installations without the patient portal, or not running a version before 8.3.0, can skip it.
Not affected if patient-portal-disabled, version-8.3.0-or-later
Who cares healthcare, openemr, patient-portal, phi
8.3.0 are listed as affected.api/onsitedocuments with a Pid parameter.8.3.0 or later (the sources state the fix is in versions before 8.3.0 being affected).OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query() that allows authenticated portal patients to bypass the lowercase pid authorization guard by supplying a capitalised Pid parameter. Attackers can request the api/onsitedocuments endpoint with Pid set to another patient's id to overwrite the session-pinned criteria and read other patients' onsite documents containing PHI.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.