{"id":"CVE-2026-124484","kind":"vulnerability","aliases":["CVE-2026-124484"],"related":[],"title":"OpenEMR: authenticated users can read and overwrite other patients' documents","description":"OpenEMR before 8.4.0 contains a missing authorization vulnerability in portal onsite-document APIs that allows any authenticated core user to access cross-patient documents. Attackers can omit the patientId parameter and supply arbitrary record IDs to list, read, and overwrite other patients' portal documents, signatures, and template data.","summary":"OpenEMR before 8.4.0 exposes portal onsite-document APIs without an authorization check. Any signed-in core user can list, read and overwrite other patients' portal documents, signatures and template data by omitting patientId and supplying arbitrary record IDs.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","patient-portal","runtime","self-hosted"],"not_affected_if":["version-8.4.0-or-later"],"how_to_check":"- Check the OpenEMR version in the installation; versions before `8.4.0` are affected.","fix":"- OpenEMR: upgrade to `8.4.0` or later","status":"open","published_at":"2026-11-08T14:18:17+00:00","first_seen_at":"2026-11-08T14:48:41+00:00","triaged_at":"2026-11-08T14:48:57+00:00","updated_at":"2026-11-08T14:48:57+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-08T14:48:57Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: upgrade to `8.4.0` or later\n- unknown","reach":"network","title":"OpenEMR: authenticated users can read and overwrite other patients' documents","impact":"high","summary":"OpenEMR before 8.4.0 exposes portal onsite-document APIs without an authorization check. Any signed-in core user can list, read and overwrite other patients' portal documents, signatures and template data by omitting patientId and supplying arbitrary record IDs.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","self-hosted","healthcare","patient-portal"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads and overwrites other patients' portal documents and signatures","analyst_note":"Confirm whether the patient portal must be enabled for the onsite-document APIs to respond; check the vendor advisory at github.com for the exact affected endpoints.","how_to_check":"- Check the OpenEMR version in the installation; versions before `8.4.0` are affected.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-8.4.0-or-later"],"who_is_affected":"Clinics and practices that self-host OpenEMR with the patient portal enabled are exposed, because any authenticated core user can reach the onsite-document APIs. Installations on earlier versions with the portal turned off, or with no core user accounts beyond trusted staff, carry less exposure. unknown whether the portal must be enabled for the endpoints to answer.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000752,"input_tokens":4608,"output_tokens":582,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124484':13A,16A '-2026':12A,15A '8.4.0':28B,68C 'access':87C 'allow':81C 'api':34B,79C 'arbitrari':63B,100C 'attack':92C 'authent':2A,83C 'author':37B,72C 'check':38B 'contain':69C 'core':43B,84C 'cross':89C 'cross-pati':88C 'cve':11A,14A 'data':57B,115C 'document':10A,33B,53B,78C,91C,111C 'expos':29B 'healthcar':17B 'host':25B 'id':65B,102C 'list':46B,104C 'miss':71C 'omit':59B,94C 'onsit':32B,77C 'onsite-docu':31B,76C 'openemr':1A,18B,26B,66C 'overwrit':7A,49B,107C 'paramet':97C 'patient':9A,20B,51B,90C,109C 'patient-port':19B 'patientid':60B,96C 'portal':21B,30B,52B,75C,110C 'read':5A,47B,105C 'record':64B,101C 'runtim':22B 'self':24B 'self-host':23B 'sign':41B 'signatur':54B,112C 'signed-in':40B 'suppli':62B,99C 'templat':56B,114C 'user':3A,44B,85C 'vulner':73C 'without':35B","nicknames":[],"mitigations":[],"who_affected":"Clinics and practices that self-host OpenEMR with the patient portal enabled are exposed, because any authenticated core user can reach the onsite-document APIs. Installations on earlier versions with the portal turned off, or with no core user accounts beyond trusted staff, carry less exposure. unknown whether the portal must be enabled for the endpoints to answer.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","patientportal","runtime","selfhosted"],"campaign_type":null,"search_a":"'-124484':13A,16A '-2026':12A,15A 'authent':2A 'cve':11A,14A 'document':10A 'openemr':1A 'overwrit':7A 'patient':9A 'read':5A 'user':3A","search_b":"'8.4.0':28B 'api':34B 'arbitrari':63B 'author':37B 'check':38B 'core':43B 'data':57B 'document':33B,53B 'expos':29B 'healthcar':17B 'host':25B 'id':65B 'list':46B 'omit':59B 'onsit':32B 'onsite-docu':31B 'openemr':18B,26B 'overwrit':49B 'patient':20B,51B 'patient-port':19B 'patientid':60B 'portal':21B,30B,52B 'read':47B 'record':64B 'runtim':22B 'self':24B 'self-host':23B 'sign':41B 'signatur':54B 'signed-in':40B 'suppli':62B 'templat':56B 'user':44B 'without':35B","search_c":"'8.4.0':68C 'access':87C 'allow':81C 'api':79C 'arbitrari':100C 'attack':92C 'authent':83C 'author':72C 'contain':69C 'core':84C 'cross':89C 'cross-pati':88C 'data':115C 'document':78C,91C,111C 'id':102C 'list':104C 'miss':71C 'omit':94C 'onsit':77C 'onsite-docu':76C 'openemr':66C 'overwrit':107C 'paramet':97C 'patient':90C,109C 'patientid':96C 'portal':75C,110C 'read':105C 'record':101C 'signatur':112C 'suppli':99C 'templat':114C 'user':85C 'vulner':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-13T09:39:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124484","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124484","severity":null,"published_at":"2026-11-08T14:18:17+00:00","modified_at":"2026-11-08T14:18:17+00:00","first_seen_at":"2026-11-08T14:48:41+00:00","fetched_at":"2026-11-08T14:48:41+00:00","note":null}],"documents":[{"id":102156,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-4r76-rq83-hgpg","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-13T09:39:04+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102157,"url":"https://www.vulncheck.com/advisories/openemr-before-8.4.0-missing-authorization-in-portal-onsite-document-apis","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}