---
id: "CVE-2026-124471"
page: "https://infrastack.ai/live/CVE-2026-124471"
kind: "vulnerability"
aliases: ["CVE-2026-124471"]
title: "OpenEMR: missing authorization lets any logged-in user read and edit billing"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "OpenEMR", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["healthcare", "openemr", "other", "self-hosted"]
not_affected_if: ["openemr-8.3.0-or-later"]
published_at: "2026-11-08T14:18:15+00:00"
first_seen_at: "2026-11-08T14:48:40+00:00"
updated_at: "2026-11-08T14:49:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124471", "first_seen_at": "2026-11-08T14:48:40+00:00"}]
exploit_sources: []
---

# OpenEMR: missing authorization lets any logged-in user read and edit billing

Link for people: https://infrastack.ai/live/CVE-2026-124471 (this .md is for agents)

OpenEMR before 8.3.0 has a missing authorization check in its billing EOB invoice page, so any authenticated user can view and change billing data for any encounter. An attacker with a normal account can read patient names and billing notes and post payments, adjustments, deletions or notes against any patient.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:OpenEMR affected range not listed fixed no fixed version listed

## How to check

- Check the installed OpenEMR version and confirm whether it is below `8.3.0`
- Look for the file `interface/billing/sl_eob_invoice.php` in the OpenEMR install

## Fix

- OpenEMR: upgrade to `8.3.0` or later

## Timeline

- 2026-11-08T14:48:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124471

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openemr/openemr/security/advisories/GHSA-55gc-5wj7-xxp7
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openemr-before-8.3.0-missing-authorization-and-idor-via-sl-eob-invoice-php

## From the sources

OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_invoice.php that allows any authenticated user to read and modify billing data for any encounter. Attackers can iterate the id parameter to read patient names and billing notes, and post payments, adjustments, deletions, or billing notes against any patient's account.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_