{"id":"CVE-2026-124478","kind":"vulnerability","aliases":["CVE-2026-124478"],"related":[],"title":"OpenEMR: low-privileged users can overwrite other patients' recall records","description":"OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.php that allows low-privileged authenticated users to modify arbitrary patients' recall data. Attackers can submit a crafted new_pid with recall, contact, provider, facility, and notification preference fields to overwrite records of patients they cannot access.","summary":"OpenEMR before 8.3.0 lacks an authorization check in the addRecall action of the messages save endpoint. A logged-in low-privileged user can submit a crafted patient ID and overwrite recall, contact, provider and notification data for patients they cannot access.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OpenEMR","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["healthcare","openemr","php","runtime","self-hosted"],"not_affected_if":["no-low-privilege-users","openemr-8.3.0-or-later"],"how_to_check":"- Check the OpenEMR version in the deployment (for example the version shown in the admin footer or the `version` file in the install).\n- Confirm whether `/interface/main/messages/save.php` is reachable by low-privileged accounts.","fix":"- OpenEMR: move to `8.3.0` or later.","status":"open","published_at":"2026-11-08T14:18:16+00:00","first_seen_at":"2026-11-08T14:48:41+00:00","triaged_at":"2026-11-08T14:49:32+00:00","updated_at":"2026-11-08T14:49:32+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-08T14:49:32Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.3.0` or later.","reach":"network","title":"OpenEMR: low-privileged users can overwrite other patients' recall records","impact":"medium","summary":"OpenEMR before 8.3.0 lacks an authorization check in the addRecall action of the messages save endpoint. A logged-in low-privileged user can submit a crafted patient ID and overwrite recall, contact, provider and notification data for patients they cannot access.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker alters records of patients they cannot access.","analyst_note":"","how_to_check":"- Check the OpenEMR version in the deployment (for example the version shown in the admin footer or the `version` file in the install).\n- Confirm whether `/interface/main/messages/save.php` is reachable by low-privileged accounts.","plain_action":"","product_name":"OpenEMR","needs_analyst":false,"not_affected_if":["openemr-8.3.0-or-later","no-low-privilege-users"],"who_is_affected":"Clinics and organisations running self-hosted OpenEMR before 8.3.0 where staff with limited accounts can log in. Exposure depends on authenticated low-privileged users existing; instances with only fully privileged users have less exposure. Hosted or managed OpenEMR should be confirmed with the provider.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000748,"input_tokens":4615,"output_tokens":573,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124478':14A,17A '-2026':13A,16A '/interface/main/messages/save.php':82C '8.3.0':28B,71C 'access':68B,119C 'action':36B,80C 'addrecal':35B,79C 'allow':84C 'arbitrari':92C 'attack':96C 'authent':88C 'author':31B,75C 'cannot':67B,118C 'check':32B 'contact':59B,105C 'contain':72C 'craft':53B,100C 'cve':12A,15A 'data':63B,95C 'endpoint':41B 'facil':107C 'field':111C 'healthcar':19B 'host':25B 'id':55B 'lack':29B 'log':44B 'logged-in':43B 'low':3A,47B,86C 'low-privileg':2A,46B,85C 'messag':39B 'miss':74C 'modifi':91C 'new':101C 'notif':62B,109C 'openemr':1A,18A,20B,26B,69C 'overwrit':7A,57B,113C 'patient':9A,54B,65B,93C,116C 'php':21B 'pid':102C 'prefer':110C 'privileg':4A,48B,87C 'provid':60B,106C 'recal':10A,58B,94C,104C 'record':11A,114C 'runtim':22B 'save':40B 'self':24B 'self-host':23B 'submit':51B,98C 'user':5A,49B,89C 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Clinics and organisations running self-hosted OpenEMR before 8.3.0 where staff with limited accounts can log in. Exposure depends on authenticated low-privileged users existing; instances with only fully privileged users have less exposure. Hosted or managed OpenEMR should be confirmed with the provider.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["openemr"],"ptokens":["openemr"],"labels":["healthcare","high","openemr","php","runtime","selfhosted","vendor"],"campaign_type":null,"search_a":"'-124478':14A,17A '-2026':13A,16A 'cve':12A,15A 'low':3A 'low-privileg':2A 'openemr':1A,18A 'overwrit':7A 'patient':9A 'privileg':4A 'recal':10A 'record':11A 'user':5A","search_b":"'8.3.0':28B 'access':68B 'action':36B 'addrecal':35B 'author':31B 'cannot':67B 'check':32B 'contact':59B 'craft':53B 'data':63B 'endpoint':41B 'healthcar':19B 'host':25B 'id':55B 'lack':29B 'log':44B 'logged-in':43B 'low':47B 'low-privileg':46B 'messag':39B 'notif':62B 'openemr':20B,26B 'overwrit':57B 'patient':54B,65B 'php':21B 'privileg':48B 'provid':60B 'recal':58B 'runtim':22B 'save':40B 'self':24B 'self-host':23B 'submit':51B 'user':49B","search_c":"'/interface/main/messages/save.php':82C '8.3.0':71C 'access':119C 'action':80C 'addrecal':79C 'allow':84C 'arbitrari':92C 'attack':96C 'authent':88C 'author':75C 'cannot':118C 'contact':105C 'contain':72C 'craft':100C 'data':95C 'facil':107C 'field':111C 'low':86C 'low-privileg':85C 'miss':74C 'modifi':91C 'new':101C 'notif':109C 'openemr':69C 'overwrit':113C 'patient':93C,116C 'pid':102C 'prefer':110C 'privileg':87C 'provid':106C 'recal':94C,104C 'record':114C 'submit':98C 'user':89C 'vulner':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-08-18T08:58:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124478","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124478","severity":null,"published_at":"2026-11-08T14:18:16+00:00","modified_at":"2026-11-08T14:18:16+00:00","first_seen_at":"2026-11-08T14:48:41+00:00","fetched_at":"2026-11-08T14:48:41+00:00","note":null}],"documents":[{"id":102144,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-j347-wp33-79q9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-18T08:58:24+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102145,"url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-missing-authorization-via-addrecall-in-save-php","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}