CVE-2026-124472 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR, an electronic health records system, has a missing authorization check in its billing EOB patient note page. Any authenticated user, including low-privilege accounts, can read and modify confidential patient billing notes by changing the patient_id value.
first public Aug 18, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Clinics and organizations that run OpenEMR on their own servers with user accounts that have low privileges are exposed, since any logged-in account can reach the billing note page. Installations on a vendor-managed host or with no non-admin accounts are less exposed, but the sources do not say which configurations are safe.
Not affected if managed-hosting
Who cares healthcare, openemr, php, self-hosted
version file of the install.interface/billing/sl_eob_patient_note.php in the install directory.8.3.0 are affected; move to 8.3.0 or later.OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_patient_note.php that allows any authenticated user to read and modify patient billing notes. Attackers with low-privilege accounts can enumerate the patient_id parameter and submit POST requests using the embedded CSRF token to view or tamper with confidential billing data.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.