CVE-2026-124477 · Package
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.3.0 has a missing authorization check on the delete_Recall action, so any logged-in user can delete patient recall records by ID. An attacker can remove another patient's recall data without the access rights or ownership that should be required.
first public Aug 18, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any OpenEMR instance before 8.3.0 where a low-privileged authenticated user can reach the messages/save.php endpoint. The flaw needs only a normal logged-in account, not an administrator. Installations already on 8.3.0 or later are not affected.
Not affected if version-8.3.0-or-later
Who cares healthcare, openemr, self-hosted
8.3.0 or later is not affected.8.3.0 or later.OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete arbitrary patient recall records via the delete_Recall action. Attackers can send POST requests to /interface/main/messages/save.php with a target pid and r_ID to remove recall data without ACL or ownership checks.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.