{"id":"CVE-2026-124470","kind":"vulnerability","aliases":["CVE-2026-124470"],"related":[],"title":"OpenEMR: patient portal lets logged-in patients read other patients' problem lists","description":"OpenEMR before 8.3.0 contains a broken object level authorization vulnerability in portal/report/portal_custom_report.php that allows authenticated portal patients to read other patients' problem list entries. Attackers can enumerate sequential IDs in issue_ parameter names to retrieve other patients' problem titles, clinical notes, ICD diagnosis codes, and IPPF contraceptive records.","summary":"OpenEMR before 8.3.0 has a broken access control flaw in its patient portal report page, portal/report/portal_custom_report.php. An authenticated portal patient can enumerate sequential issue IDs to read other patients' problem titles, clinical notes, ICD diagnosis codes and contraceptive records.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","patient-portal","runtime","self-hosted"],"not_affected_if":["managed-hosting","portal-disabled"],"how_to_check":"- Check the OpenEMR version in the installed application; versions below `8.3.0` are in the affected range.\n- Confirm whether the patient portal is enabled for patients on the instance.","fix":"- OpenEMR: move to `8.3.0` or later.","status":"open","published_at":"2026-11-08T14:18:15+00:00","first_seen_at":"2026-11-08T14:48:40+00:00","triaged_at":"2026-11-08T14:49:38+00:00","updated_at":"2026-11-08T14:49:38+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-08T14:49:38Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.3.0` or later.","reach":"internet","title":"OpenEMR: patient portal lets logged-in patients read other patients' problem lists","impact":"medium","summary":"OpenEMR before 8.3.0 has a broken access control flaw in its patient portal report page, portal/report/portal_custom_report.php. An authenticated portal patient can enumerate sequential issue IDs to read other patients' problem titles, clinical notes, ICD diagnosis codes and contraceptive records.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","self-hosted","healthcare","patient-portal"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"patients read other patients' clinical records and diagnoses","analyst_note":"Confirm whether the patient portal must be enabled for the flaw to be reachable and whether the vendor advisory states a different fix path.\n\n","how_to_check":"- Check the OpenEMR version in the installed application; versions below `8.3.0` are in the affected range.\n- Confirm whether the patient portal is enabled for patients on the instance.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["portal-disabled","managed-hosting"],"who_is_affected":"Clinics and health organisations that run self-hosted OpenEMR with the patient portal enabled. The flaw needs a logged-in patient portal account, so instances without the portal or with managed hosting are less exposed; the sources do not say more.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000747,"input_tokens":4619,"output_tokens":571,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124470':16A,19A '-2026':15A,18A '8.3.0':31B,70C 'access':35B 'allow':81C 'attack':92C 'authent':46B,82C 'author':76C 'broken':34B,73C 'clinic':60B,107C 'code':64B,111C 'contain':71C 'contracept':66B,114C 'control':36B 'cve':14A,17A 'diagnosi':63B,110C 'entri':91C 'enumer':50B,94C 'flaw':37B 'healthcar':20B 'host':28B 'icd':62B,109C 'id':53B,96C 'ippf':113C 'issu':52B,98C 'let':4A 'level':75C 'list':13A,90C 'log':6A 'logged-in':5A 'name':100C 'note':61B,108C 'object':74C 'openemr':1A,21B,29B,68C 'page':43B 'paramet':99C 'patient':2A,8A,11A,23B,40B,48B,57B,84C,88C,104C 'patient-port':22B 'portal':3A,24B,41B,47B,83C 'portal/report/portal_custom_report.php':44B,79C 'problem':12A,58B,89C,105C 'read':9A,55B,86C 'record':67B,115C 'report':42B 'retriev':102C 'runtim':25B 'self':27B 'self-host':26B 'sequenti':51B,95C 'titl':59B,106C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Clinics and health organisations that run self-hosted OpenEMR with the patient portal enabled. The flaw needs a logged-in patient portal account, so instances without the portal or with managed hosting are less exposed; the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","patientportal","runtime","selfhosted"],"campaign_type":null,"search_a":"'-124470':16A,19A '-2026':15A,18A 'cve':14A,17A 'let':4A 'list':13A 'log':6A 'logged-in':5A 'openemr':1A 'patient':2A,8A,11A 'portal':3A 'problem':12A 'read':9A","search_b":"'8.3.0':31B 'access':35B 'authent':46B 'broken':34B 'clinic':60B 'code':64B 'contracept':66B 'control':36B 'diagnosi':63B 'enumer':50B 'flaw':37B 'healthcar':20B 'host':28B 'icd':62B 'id':53B 'issu':52B 'note':61B 'openemr':21B,29B 'page':43B 'patient':23B,40B,48B,57B 'patient-port':22B 'portal':24B,41B,47B 'portal/report/portal_custom_report.php':44B 'problem':58B 'read':55B 'record':67B 'report':42B 'runtim':25B 'self':27B 'self-host':26B 'sequenti':51B 'titl':59B","search_c":"'8.3.0':70C 'allow':81C 'attack':92C 'authent':82C 'author':76C 'broken':73C 'clinic':107C 'code':111C 'contain':71C 'contracept':114C 'diagnosi':110C 'entri':91C 'enumer':94C 'icd':109C 'id':96C 'ippf':113C 'issu':98C 'level':75C 'list':90C 'name':100C 'note':108C 'object':74C 'openemr':68C 'paramet':99C 'patient':84C,88C,104C 'portal':83C 'portal/report/portal_custom_report.php':79C 'problem':89C,105C 'read':86C 'record':115C 'retriev':102C 'sequenti':95C 'titl':106C 'vulner':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-08-18T09:12:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124470","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124470","severity":null,"published_at":"2026-11-08T14:18:15+00:00","modified_at":"2026-11-08T14:18:15+00:00","first_seen_at":"2026-11-08T14:48:40+00:00","fetched_at":"2026-11-08T14:48:40+00:00","note":null}],"documents":[{"id":102126,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-xcrj-xc98-x8g6","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-18T09:12:06+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102127,"url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-bola-via-portal-custom-report-php-exposes-patient-problem-lists","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}