{"id":"CVE-2026-124473","kind":"vulnerability","aliases":["CVE-2026-124473"],"related":[],"title":"OpenEMR: SOAP note API lets users overwrite other patients' clinical notes","description":"OpenEMR before 8.3.0 contains a broken object-level authorization vulnerability in the SOAP note update API, which does not verify that the supplied SOAP note ID (sid) belongs to the supplied patient and encounter. Authenticated users with encounters/notes permission can send PUT requests to /api/patient/:pid/encounter/:eid/soap_note/:sid with another patient's sid to overwrite that clinical note and reassign its pid.","summary":"OpenEMR before 8.3.0 does not check that a SOAP note belongs to the patient and encounter named in an update request. An authenticated user with note permission can overwrite another patient's clinical note and reassign it to a different patient.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OpenEMR","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["healthcare","openemr","runtime","self-hosted"],"not_affected_if":["no-encounter-notes-permission","openemr-8.3.0-or-later"],"how_to_check":"- Check the installed OpenEMR version against `8.3.0`\n- Review who holds the `encounters/notes` permission","fix":"- OpenEMR: upgrade to `8.3.0` or later","status":"open","published_at":"2026-11-08T14:18:16+00:00","first_seen_at":"2026-11-08T14:48:40+00:00","triaged_at":"2026-11-08T14:49:35+00:00","updated_at":"2026-11-08T14:49:35+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-08T14:49:35Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: upgrade to `8.3.0` or later","reach":"network","title":"OpenEMR: SOAP note API lets users overwrite other patients' clinical notes","impact":"medium","summary":"OpenEMR before 8.3.0 does not check that a SOAP note belongs to the patient and encounter named in an update request. An authenticated user with note permission can overwrite another patient's clinical note and reassign it to a different patient.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","healthcare","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"clinical notes of other patients overwritten and reassigned","analyst_note":"Confirm the fixed version and any workaround on the vendor advisory at github.com and the VulnCheck page.","how_to_check":"- Check the installed OpenEMR version against `8.3.0`\n- Review who holds the `encounters/notes` permission","plain_action":"","product_name":"OpenEMR","needs_analyst":true,"not_affected_if":["openemr-8.3.0-or-later","no-encounter-notes-permission"],"who_is_affected":"Clinics and hospitals running OpenEMR older than 8.3.0 where staff have the encounters/notes permission. The attacker must already be a logged-in user; patients and unauthenticated visitors are not in the path.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000733,"input_tokens":4646,"output_tokens":537,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124473':14A,17A '-2026':13A,16A '/api/patient':111C '8.3.0':27B,68C 'anoth':54B,116C 'api':4A,82C 'authent':47B,101C 'author':75C 'belong':35B,94C 'broken':71C 'check':30B 'clinic':10A,57B,123C 'contain':69C 'cve':12A,15A 'differ':64B 'eid/soap_note':113C 'encount':40B,100C 'encounters/notes':104C 'healthcar':19B 'host':24B 'id':92C 'let':5A 'level':74C 'name':41B 'note':3A,11A,34B,50B,58B,80C,91C,124C 'object':73C 'object-level':72C 'openemr':1A,18A,20B,25B,66C 'overwrit':7A,53B,121C 'patient':9A,38B,55B,65B,98C,117C 'permiss':51B,105C 'pid':128C 'pid/encounter':112C 'put':108C 'reassign':60B,126C 'request':45B,109C 'runtim':21B 'self':23B 'self-host':22B 'send':107C 'sid':93C,114C,119C 'soap':2A,33B,79C,90C 'suppli':89C,97C 'updat':44B,81C 'user':6A,48B,102C 'verifi':86C 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Clinics and hospitals running OpenEMR older than 8.3.0 where staff have the encounters/notes permission. The attacker must already be a logged-in user; patients and unauthenticated visitors are not in the path.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["openemr"],"ptokens":["openemr"],"labels":["healthcare","high","openemr","runtime","selfhosted","vendor"],"campaign_type":null,"search_a":"'-124473':14A,17A '-2026':13A,16A 'api':4A 'clinic':10A 'cve':12A,15A 'let':5A 'note':3A,11A 'openemr':1A,18A 'overwrit':7A 'patient':9A 'soap':2A 'user':6A","search_b":"'8.3.0':27B 'anoth':54B 'authent':47B 'belong':35B 'check':30B 'clinic':57B 'differ':64B 'encount':40B 'healthcar':19B 'host':24B 'name':41B 'note':34B,50B,58B 'openemr':20B,25B 'overwrit':53B 'patient':38B,55B,65B 'permiss':51B 'reassign':60B 'request':45B 'runtim':21B 'self':23B 'self-host':22B 'soap':33B 'updat':44B 'user':48B","search_c":"'/api/patient':111C '8.3.0':68C 'anoth':116C 'api':82C 'authent':101C 'author':75C 'belong':94C 'broken':71C 'clinic':123C 'contain':69C 'eid/soap_note':113C 'encount':100C 'encounters/notes':104C 'id':92C 'level':74C 'note':80C,91C,124C 'object':73C 'object-level':72C 'openemr':66C 'overwrit':121C 'patient':98C,117C 'permiss':105C 'pid':128C 'pid/encounter':112C 'put':108C 'reassign':126C 'request':109C 'send':107C 'sid':93C,114C,119C 'soap':79C,90C 'suppli':89C,97C 'updat':81C 'user':102C 'verifi':86C 'vulner':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-08-18T09:00:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124473","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124473","severity":null,"published_at":"2026-11-08T14:18:16+00:00","modified_at":"2026-11-08T14:18:16+00:00","first_seen_at":"2026-11-08T14:48:40+00:00","fetched_at":"2026-11-08T14:48:40+00:00","note":null}],"documents":[{"id":102132,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-jf26-6rhx-xw6m","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-18T09:00:26+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102133,"url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-broken-object-authorization-via-soap-note-update-api","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}