OPENEMR · CVE-2026-124471 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.3.0 has a missing authorization check in its billing EOB invoice page, so any authenticated user can view and change billing data for any encounter. An attacker with a normal account can read patient names and billing notes and post payments, adjustments, deletions or notes against any patient.
first public Aug 18, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any clinic or organization running OpenEMR older than 8.3.0 where ordinary staff accounts exist. Installations on 8.3.0 or later are not affected by this flaw; the sources do not say whether a non-default setting is required.
Not affected if openemr-8.3.0-or-later
Who cares healthcare, openemr, self-hosted
8.3.0interface/billing/sl_eob_invoice.php in the OpenEMR install8.3.0 or laterOpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_invoice.php that allows any authenticated user to read and modify billing data for any encounter. Attackers can iterate the id parameter to read patient names and billing notes, and post payments, adjustments, deletions, or billing notes against any patient's account.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.