CVE-2026-124476 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR, an electronic health records system, lets a logged-in patient portal user submit a patient ID that is not checked against their own session. An attacker can insert or change payment-audit records in other patients' billing data.
first public Aug 18, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Clinics and practices that run OpenEMR before 8.3.0 with the patient portal enabled and payment features (AuthorizeNet, Stripe or Sphere) in use. An attacker needs a portal patient account, so sites without patient portal logins are lower risk.
Not affected if patient-portal-disabled, version-8.3.0-or-later
Who cares healthcare, openemr, php, self-hosted
version.php or the admin About page; versions before 8.3.0 are affected8.3.0 or laterOpenEMR before 8.3.0 contains an insecure direct object reference in portal/lib/paylib.php, which writes the request-supplied form_pid (or the patient_id_cc value in Sphere data) to onsite_portal_activity without checking it against the session patient. Authenticated portal patients can submit portal-save, review-save, AuthorizeNet, Stripe, or Sphere requests to insert or modify forged payment-audit records in other patients' billing records.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.