CVE-2026-124484 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.4.0 exposes portal onsite-document APIs without an authorization check. Any signed-in core user can list, read and overwrite other patients' portal documents, signatures and template data by omitting patientId and supplying arbitrary record IDs.
first public Sep 13, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Clinics and practices that self-host OpenEMR with the patient portal enabled are exposed, because any authenticated core user can reach the onsite-document APIs. Installations on earlier versions with the portal turned off, or with no core user accounts beyond trusted staff, carry less exposure. unknown whether the portal must be enabled for the endpoints to answer.
Not affected if version-8.4.0-or-later
Who cares healthcare, openemr, patient-portal, self-hosted
8.4.0 are affected.8.4.0 or laterOpenEMR before 8.4.0 contains a missing authorization vulnerability in portal onsite-document APIs that allows any authenticated core user to access cross-patient documents. Attackers can omit the patientId parameter and supply arbitrary record IDs to list, read, and overwrite other patients' portal documents, signatures, and template data.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.