{"id":"CVE-2026-124481","kind":"vulnerability","aliases":["CVE-2026-124481"],"related":[],"title":"OpenEMR: patient portal lets patients forge payment credits for other patients","description":"OpenEMR before 8.4.0 contains an improper authorization vulnerability in Rainforest patient portal payments that trusts browser-supplied patientId, encounter, and amount values instead of deriving them from the portal session. Authenticated portal patients can tamper with JSON sent to portal_payment.rainforest.php so the payin.authorized webhook writes forged ar_activity credits to other patients' encounters exceeding the amount actually paid.","summary":"In OpenEMR before 8.4.0, the Rainforest patient portal payment handler trusts patientId, encounter and amount values sent by the browser. An authenticated patient can alter the request so the payment webhook records forged credits against other patients' encounters, exceeding what was actually paid.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OpenEMR","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["healthcare","openemr","other","patient-portal","rainforest-payments","self-hosted"],"not_affected_if":["no-patient-portal","no-rainforest-payments","openemr-8.4.0-or-later"],"how_to_check":"- Check the OpenEMR version on the installation; versions before `8.4.0` are affected.\n- Check whether Rainforest patient portal payments are enabled; the sources do not say how to confirm this.","fix":"- OpenEMR: upgrade to `8.4.0` or later.","status":"open","published_at":"2026-11-08T14:18:17+00:00","first_seen_at":"2026-11-08T14:48:41+00:00","triaged_at":"2026-11-08T14:49:33+00:00","updated_at":"2026-11-08T14:49:33+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-08T14:49:33Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: upgrade to `8.4.0` or later.","reach":"internet","title":"OpenEMR: patient portal lets patients forge payment credits for other patients","impact":"high","summary":"In OpenEMR before 8.4.0, the Rainforest patient portal payment handler trusts patientId, encounter and amount values sent by the browser. An authenticated patient can alter the request so the payment webhook records forged credits against other patients' encounters, exceeding what was actually paid.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","healthcare","patient-portal","rainforest-payments","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Patients write forged payment credits into other patients' billing records","analyst_note":"","how_to_check":"- Check the OpenEMR version on the installation; versions before `8.4.0` are affected.\n- Check whether Rainforest patient portal payments are enabled; the sources do not say how to confirm this.","plain_action":"","product_name":"OpenEMR","needs_analyst":false,"not_affected_if":["openemr-8.4.0-or-later","no-rainforest-payments","no-patient-portal"],"who_is_affected":"Clinics and organizations that run OpenEMR with the patient portal and Rainforest payments enabled are exposed. An attacker needs a valid patient portal login. Installations on OpenEMR 8.4.0 or later, or without Rainforest payments, are not affected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001163,"input_tokens":4643,"output_tokens":1398,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124481':14A,17A '-2026':13A,16A '8.4.0':34B,76C 'activ':122C 'actual':72B,131C 'alter':55B 'amount':45B,95C,130C 'ar':121C 'authent':52B,105C 'author':80C 'browser':50B,90C 'browser-suppli':89C 'contain':77C 'credit':8A,64B,123C 'cve':12A,15A 'deriv':99C 'encount':43B,68B,93C,127C 'exceed':69B,128C 'forg':6A,63B,120C 'handler':40B 'healthcar':19B 'host':30B 'improp':79C 'instead':97C 'json':111C 'let':4A 'openemr':1A,18A,20B,32B,74C 'paid':73B,132C 'patient':2A,5A,11A,23B,37B,53B,67B,84C,107C,126C 'patient-port':22B 'patientid':42B,92C 'payin.authorized':117C 'payment':7A,27B,39B,60B,86C 'portal':3A,24B,38B,85C,103C,106C 'portal_payment.rainforest.php':114C 'rainforest':26B,36B,83C 'rainforest-pay':25B 'record':62B 'request':57B 'self':29B 'self-host':28B 'sent':47B,112C 'session':104C 'suppli':91C 'tamper':109C 'trust':41B,88C 'valu':46B,96C 'vulner':81C 'webhook':61B,118C 'write':119C","nicknames":[],"mitigations":[],"who_affected":"Clinics and organizations that run OpenEMR with the patient portal and Rainforest payments enabled are exposed. An attacker needs a valid patient portal login. Installations on OpenEMR 8.4.0 or later, or without Rainforest payments, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["openemr"],"ptokens":["openemr"],"labels":["healthcare","high","openemr","other","patientportal","rainforestpayments","selfhosted","vendor"],"campaign_type":null,"search_a":"'-124481':14A,17A '-2026':13A,16A 'credit':8A 'cve':12A,15A 'forg':6A 'let':4A 'openemr':1A,18A 'patient':2A,5A,11A 'payment':7A 'portal':3A","search_b":"'8.4.0':34B 'actual':72B 'alter':55B 'amount':45B 'authent':52B 'browser':50B 'credit':64B 'encount':43B,68B 'exceed':69B 'forg':63B 'handler':40B 'healthcar':19B 'host':30B 'openemr':20B,32B 'paid':73B 'patient':23B,37B,53B,67B 'patient-port':22B 'patientid':42B 'payment':27B,39B,60B 'portal':24B,38B 'rainforest':26B,36B 'rainforest-pay':25B 'record':62B 'request':57B 'self':29B 'self-host':28B 'sent':47B 'trust':41B 'valu':46B 'webhook':61B","search_c":"'8.4.0':76C 'activ':122C 'actual':131C 'amount':95C,130C 'ar':121C 'authent':105C 'author':80C 'browser':90C 'browser-suppli':89C 'contain':77C 'credit':123C 'deriv':99C 'encount':93C,127C 'exceed':128C 'forg':120C 'improp':79C 'instead':97C 'json':111C 'openemr':74C 'paid':132C 'patient':84C,107C,126C 'patientid':92C 'payin.authorized':117C 'payment':86C 'portal':85C,103C,106C 'portal_payment.rainforest.php':114C 'rainforest':83C 'sent':112C 'session':104C 'suppli':91C 'tamper':109C 'trust':88C 'valu':96C 'vulner':81C 'webhook':118C 'write':119C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-13T09:39:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124481","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124481","severity":null,"published_at":"2026-11-08T14:18:17+00:00","modified_at":"2026-11-08T14:18:17+00:00","first_seen_at":"2026-11-08T14:48:41+00:00","fetched_at":"2026-11-08T14:48:41+00:00","note":null}],"documents":[{"id":102150,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-525m-fch5-vqqm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-13T09:39:51+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102151,"url":"https://www.vulncheck.com/advisories/openemr-before-8.4.0-cross-patient-payment-tampering-via-rainforest-portal-payments","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}