OPENEMR · CVE-2026-124478 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.3.0 lacks an authorization check in the addRecall action of the messages save endpoint. A logged-in low-privileged user can submit a crafted patient ID and overwrite recall, contact, provider and notification data for patients they cannot access.
first public Aug 18, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Clinics and organisations running self-hosted OpenEMR before 8.3.0 where staff with limited accounts can log in. Exposure depends on authenticated low-privileged users existing; instances with only fully privileged users have less exposure. Hosted or managed OpenEMR should be confirmed with the provider.
Not affected if no-low-privilege-users, openemr-8.3.0-or-later
Who cares healthcare, openemr, php, self-hosted
version file in the install)./interface/main/messages/save.php is reachable by low-privileged accounts.8.3.0 or later.OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.php that allows low-privileged authenticated users to modify arbitrary patients' recall data. Attackers can submit a crafted new_pid with recall, contact, provider, facility, and notification preference fields to overwrite records of patients they cannot access.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.