{"id":"CVE-2026-124471","kind":"vulnerability","aliases":["CVE-2026-124471"],"related":[],"title":"OpenEMR: missing authorization lets any logged-in user read and edit billing","description":"OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_invoice.php that allows any authenticated user to read and modify billing data for any encounter. Attackers can iterate the id parameter to read patient names and billing notes, and post payments, adjustments, deletions, or billing notes against any patient's account.","summary":"OpenEMR before 8.3.0 has a missing authorization check in its billing EOB invoice page, so any authenticated user can view and change billing data for any encounter. An attacker with a normal account can read patient names and billing notes and post payments, adjustments, deletions or notes against any patient.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OpenEMR","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["healthcare","openemr","other","self-hosted"],"not_affected_if":["openemr-8.3.0-or-later"],"how_to_check":"- Check the installed OpenEMR version and confirm whether it is below `8.3.0`\n- Look for the file `interface/billing/sl_eob_invoice.php` in the OpenEMR install","fix":"- OpenEMR: upgrade to `8.3.0` or later","status":"open","published_at":"2026-11-08T14:18:15+00:00","first_seen_at":"2026-11-08T14:48:40+00:00","triaged_at":"2026-11-08T14:49:12+00:00","updated_at":"2026-11-08T14:49:12+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-08T14:49:12Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: upgrade to `8.3.0` or later","reach":"network","title":"OpenEMR: missing authorization lets any logged-in user read and edit billing","impact":"high","summary":"OpenEMR before 8.3.0 has a missing authorization check in its billing EOB invoice page, so any authenticated user can view and change billing data for any encounter. An attacker with a normal account can read patient names and billing notes and post payments, adjustments, deletions or notes against any patient.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","self-hosted","healthcare"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Any staff account reads and alters patient billing records","analyst_note":"","how_to_check":"- Check the installed OpenEMR version and confirm whether it is below `8.3.0`\n- Look for the file `interface/billing/sl_eob_invoice.php` in the OpenEMR install","plain_action":"","product_name":"OpenEMR","needs_analyst":false,"not_affected_if":["openemr-8.3.0-or-later"],"who_is_affected":"Any clinic or organization running OpenEMR older than 8.3.0 where ordinary staff accounts exist. Installations on 8.3.0 or later are not affected by this flaw; the sources do not say whether a non-default setting is required.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000729,"input_tokens":4619,"output_tokens":534,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124471':16A,19A '-2026':15A,18A '8.3.0':29B,79C 'account':59B,126C 'adjust':70B,117C 'allow':88C 'attack':55B,101C 'authent':43B,90C 'author':3A,33B,83C 'bill':13A,37B,49B,65B,96C,112C,120C 'chang':48B 'check':34B 'contain':80C 'cve':14A,17A 'data':50B,97C 'delet':71B,118C 'edit':12A 'encount':53B,100C 'eob':38B 'healthcar':21B 'host':26B 'id':105C 'interface/billing/sl_eob_invoice.php':86C 'invoic':39B 'iter':103C 'let':4A 'log':7A 'logged-in':6A 'miss':2A,32B,82C 'modifi':95C 'name':63B,110C 'normal':58B 'note':66B,73B,113C,121C 'openemr':1A,20A,22B,27B,77C 'page':40B 'paramet':106C 'patient':62B,76B,109C,124C 'payment':69B,116C 'post':68B,115C 'read':10A,61B,93C,108C 'self':25B 'self-host':24B 'user':9A,44B,91C 'view':46B 'vulner':84C","nicknames":[],"mitigations":[],"who_affected":"Any clinic or organization running OpenEMR older than 8.3.0 where ordinary staff accounts exist. Installations on 8.3.0 or later are not affected by this flaw; the sources do not say whether a non-default setting is required.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["openemr"],"ptokens":["openemr"],"labels":["healthcare","high","openemr","other","selfhosted","vendor"],"campaign_type":null,"search_a":"'-124471':16A,19A '-2026':15A,18A 'author':3A 'bill':13A 'cve':14A,17A 'edit':12A 'let':4A 'log':7A 'logged-in':6A 'miss':2A 'openemr':1A,20A 'read':10A 'user':9A","search_b":"'8.3.0':29B 'account':59B 'adjust':70B 'attack':55B 'authent':43B 'author':33B 'bill':37B,49B,65B 'chang':48B 'check':34B 'data':50B 'delet':71B 'encount':53B 'eob':38B 'healthcar':21B 'host':26B 'invoic':39B 'miss':32B 'name':63B 'normal':58B 'note':66B,73B 'openemr':22B,27B 'page':40B 'patient':62B,76B 'payment':69B 'post':68B 'read':61B 'self':25B 'self-host':24B 'user':44B 'view':46B","search_c":"'8.3.0':79C 'account':126C 'adjust':117C 'allow':88C 'attack':101C 'authent':90C 'author':83C 'bill':96C,112C,120C 'contain':80C 'data':97C 'delet':118C 'encount':100C 'id':105C 'interface/billing/sl_eob_invoice.php':86C 'iter':103C 'miss':82C 'modifi':95C 'name':110C 'note':113C,121C 'openemr':77C 'paramet':106C 'patient':109C,124C 'payment':116C 'post':115C 'read':93C,108C 'user':91C 'vulner':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-08-18T09:01:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124471","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124471","severity":null,"published_at":"2026-11-08T14:18:15+00:00","modified_at":"2026-11-08T14:18:15+00:00","first_seen_at":"2026-11-08T14:48:40+00:00","fetched_at":"2026-11-08T14:48:40+00:00","note":null}],"documents":[{"id":102128,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-55gc-5wj7-xxp7","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-18T09:01:54+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102129,"url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-missing-authorization-and-idor-via-sl-eob-invoice-php","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}