---
id: "CVE-2026-124481"
page: "https://infrastack.ai/live/CVE-2026-124481"
kind: "vulnerability"
aliases: ["CVE-2026-124481"]
title: "OpenEMR: patient portal lets patients forge payment credits for other patients"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "OpenEMR", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["healthcare", "openemr", "other", "patient-portal", "rainforest-payments", "self-hosted"]
not_affected_if: ["no-patient-portal", "no-rainforest-payments", "openemr-8.4.0-or-later"]
published_at: "2026-11-08T14:18:17+00:00"
first_seen_at: "2026-11-08T14:48:41+00:00"
updated_at: "2026-11-08T14:49:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124481", "first_seen_at": "2026-11-08T14:48:41+00:00"}]
exploit_sources: []
---

# OpenEMR: patient portal lets patients forge payment credits for other patients

Link for people: https://infrastack.ai/live/CVE-2026-124481 (this .md is for agents)

In OpenEMR before 8.4.0, the Rainforest patient portal payment handler trusts patientId, encounter and amount values sent by the browser. An authenticated patient can alter the request so the payment webhook records forged credits against other patients' encounters, exceeding what was actually paid.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:OpenEMR affected range not listed fixed no fixed version listed

## How to check

- Check the OpenEMR version on the installation; versions before `8.4.0` are affected.
- Check whether Rainforest patient portal payments are enabled; the sources do not say how to confirm this.

## Fix

- OpenEMR: upgrade to `8.4.0` or later.

## Timeline

- 2026-11-08T14:48:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124481

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openemr/openemr/security/advisories/GHSA-525m-fch5-vqqm
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openemr-before-8.4.0-cross-patient-payment-tampering-via-rainforest-portal-payments

## From the sources

OpenEMR before 8.4.0 contains an improper authorization vulnerability in Rainforest patient portal payments that trusts browser-supplied patientId, encounter, and amount values instead of deriving them from the portal session. Authenticated portal patients can tamper with JSON sent to portal_payment.rainforest.php so the payin.authorized webhook writes forged ar_activity credits to other patients' encounters exceeding the amount actually paid.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_