---
id: "CVE-2026-124473"
page: "https://infrastack.ai/live/CVE-2026-124473"
kind: "vulnerability"
aliases: ["CVE-2026-124473"]
title: "OpenEMR: SOAP note API lets users overwrite other patients' clinical notes"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "OpenEMR", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["healthcare", "openemr", "runtime", "self-hosted"]
not_affected_if: ["no-encounter-notes-permission", "openemr-8.3.0-or-later"]
published_at: "2026-11-08T14:18:16+00:00"
first_seen_at: "2026-11-08T14:48:40+00:00"
updated_at: "2026-11-08T14:49:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124473", "first_seen_at": "2026-11-08T14:48:40+00:00"}]
exploit_sources: []
---

# OpenEMR: SOAP note API lets users overwrite other patients' clinical notes

Link for people: https://infrastack.ai/live/CVE-2026-124473 (this .md is for agents)

OpenEMR before 8.3.0 does not check that a SOAP note belongs to the patient and encounter named in an update request. An authenticated user with note permission can overwrite another patient's clinical note and reassign it to a different patient.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:OpenEMR affected range not listed fixed no fixed version listed

## How to check

- Check the installed OpenEMR version against `8.3.0`
- Review who holds the `encounters/notes` permission

## Fix

- OpenEMR: upgrade to `8.3.0` or later

## Timeline

- 2026-11-08T14:48:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124473

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openemr/openemr/security/advisories/GHSA-jf26-6rhx-xw6m
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openemr-before-8.3.0-broken-object-authorization-via-soap-note-update-api

## From the sources

OpenEMR before 8.3.0 contains a broken object-level authorization vulnerability in the SOAP note update API, which does not verify that the supplied SOAP note ID (sid) belongs to the supplied patient and encounter. Authenticated users with encounters/notes permission can send PUT requests to /api/patient/:pid/encounter/:eid/soap_note/:sid with another patient's sid to overwrite that clinical note and reassign its pid.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_