CVE-2026-124475 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.3.0 has an insecure direct object reference in portal/lib/persist.php, where a supplied setting_patient value is not checked against the logged-in patient. An authenticated patient portal user can insert or overwrite patient_settings rows for other patients, suppressing notifications, changing consent flags or altering portal preferences.
first public Aug 18, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Clinics and health organisations running OpenEMR before 8.3.0 with the patient portal enabled. Installations without the patient portal, or on 8.3.0 or later, are not exposed; the sources do not say whether other configurations are affected.
Not affected if openemr-8.3.0-or-later, portal-disabled
Who cares healthcare, openemr, patient-portal, self-hosted
8.3.0 are in the affected range.portal/lib/persist.php in the OpenEMR install and whether the patient portal is enabled.8.3.0 or later.OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authenticated portal patients to modify other patients' settings by supplying an arbitrary setting_patient value. Attackers can insert or overwrite patient_settings rows for victims to suppress notifications, tamper with consent flags, or alter portal preferences.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.