CVE-2026-124470 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.3.0 has a broken access control flaw in its patient portal report page, portal/report/portal_custom_report.php. An authenticated portal patient can enumerate sequential issue IDs to read other patients' problem titles, clinical notes, ICD diagnosis codes and contraceptive records.
first public Aug 18, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Clinics and health organisations that run self-hosted OpenEMR with the patient portal enabled. The flaw needs a logged-in patient portal account, so instances without the portal or with managed hosting are less exposed; the sources do not say more.
Not affected if managed-hosting, portal-disabled
Who cares healthcare, openemr, patient-portal, self-hosted
8.3.0 are in the affected range.8.3.0 or later.OpenEMR before 8.3.0 contains a broken object level authorization vulnerability in portal/report/portal_custom_report.php that allows authenticated portal patients to read other patients' problem list entries. Attackers can enumerate sequential IDs in issue_ parameter names to retrieve other patients' problem titles, clinical notes, ICD diagnosis codes, and IPPF contraceptive records.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.