CVE-2026-124485 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.3.0 has an authorization bypass in the patient portal onsitedocuments API. An authenticated patient can blank out the patient filter and read other patients' consent forms, signatures, file paths and templates.
first public Aug 18, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Hospitals and clinics running OpenEMR with the patient portal turned on are exposed, since any logged-in patient can use the flawed API. Installs with the portal disabled, or on 8.3.0 or later, are not affected. The sources do not describe further configuration details.
Not affected if patient-portal-disabled, version-8.3.0-or-later
Who cares healthcare, openemr, patient-portal, self-hosted
8.3.0; anything earlier is in range.8.3.0 or later.OpenEMR before 8.3.0 contains an authorization bypass vulnerability in the patient portal onsitedocuments API that allows authenticated patients to read other patients' documents by overriding query criteria. Attackers can send empty pid_Equals and denialReason_IsNotLike parameters to remove patient scoping and locked filters, exposing consent bodies, signatures, file paths, and template data.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.