{"id":"CVE-2026-124485","kind":"vulnerability","aliases":["CVE-2026-124485"],"related":[],"title":"OpenEMR: patient portal API lets patients read other patients' documents","description":"OpenEMR before 8.3.0 contains an authorization bypass vulnerability in the patient portal onsitedocuments API that allows authenticated patients to read other patients' documents by overriding query criteria. Attackers can send empty pid_Equals and denialReason_IsNotLike parameters to remove patient scoping and locked filters, exposing consent bodies, signatures, file paths, and template data.","summary":"OpenEMR before 8.3.0 has an authorization bypass in the patient portal onsitedocuments API. An authenticated patient can blank out the patient filter and read other patients' consent forms, signatures, file paths and templates.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","patient-portal","runtime","self-hosted"],"not_affected_if":["patient-portal-disabled","version-8.3.0-or-later"],"how_to_check":"- Check the installed OpenEMR version against `8.3.0`; anything earlier is in range.","fix":"- OpenEMR: upgrade to `8.3.0` or later.","status":"open","published_at":"2026-11-08T14:18:17+00:00","first_seen_at":"2026-11-08T14:48:41+00:00","triaged_at":"2026-11-08T14:49:27+00:00","updated_at":"2026-11-08T14:49:27+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-08T14:49:27Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: upgrade to `8.3.0` or later.","reach":"network","title":"OpenEMR: patient portal API lets patients read other patients' documents","impact":"medium","summary":"OpenEMR before 8.3.0 has an authorization bypass in the patient portal onsitedocuments API. An authenticated patient can blank out the patient filter and read other patients' consent forms, signatures, file paths and templates.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","healthcare","patient-portal","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"patients read other patients' consent records and documents","analyst_note":"Confirm the patient portal default and whether the onsitedocuments endpoint is enabled by default; check the vendor advisory on github.com for the exact affected range.","how_to_check":"- Check the installed OpenEMR version against `8.3.0`; anything earlier is in range.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-8.3.0-or-later","patient-portal-disabled"],"who_is_affected":"Hospitals and clinics running OpenEMR with the patient portal turned on are exposed, since any logged-in patient can use the flawed API. Installs with the portal disabled, or on 8.3.0 or later, are not affected. The sources do not describe further configuration details.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000739,"input_tokens":4630,"output_tokens":551,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124485':13A,16A '-2026':12A,15A '8.3.0':28B,61C 'allow':74C 'api':4A,38B,72C 'attack':86C 'authent':40B,75C 'author':31B,64C 'blank':43B 'bodi':105C 'bypass':32B,65C 'consent':52B,104C 'contain':62C 'criteria':85C 'cve':11A,14A 'data':111C 'denialreason':93C 'document':10A,81C 'empti':89C 'equal':91C 'expos':103C 'file':55B,107C 'filter':47B,102C 'form':53B 'healthcar':17B 'host':25B 'isnotlik':94C 'let':5A 'lock':101C 'onsitedocu':37B,71C 'openemr':1A,18B,26B,59C 'overrid':83C 'paramet':95C 'path':56B,108C 'patient':2A,6A,9A,20B,35B,41B,46B,51B,69C,76C,80C,98C 'patient-port':19B 'pid':90C 'portal':3A,21B,36B,70C 'queri':84C 'read':7A,49B,78C 'remov':97C 'runtim':22B 'scope':99C 'self':24B 'self-host':23B 'send':88C 'signatur':54B,106C 'templat':58B,110C 'vulner':66C","nicknames":[],"mitigations":[],"who_affected":"Hospitals and clinics running OpenEMR with the patient portal turned on are exposed, since any logged-in patient can use the flawed API. Installs with the portal disabled, or on 8.3.0 or later, are not affected. The sources do not describe further configuration details.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","patientportal","runtime","selfhosted"],"campaign_type":null,"search_a":"'-124485':13A,16A '-2026':12A,15A 'api':4A 'cve':11A,14A 'document':10A 'let':5A 'openemr':1A 'patient':2A,6A,9A 'portal':3A 'read':7A","search_b":"'8.3.0':28B 'api':38B 'authent':40B 'author':31B 'blank':43B 'bypass':32B 'consent':52B 'file':55B 'filter':47B 'form':53B 'healthcar':17B 'host':25B 'onsitedocu':37B 'openemr':18B,26B 'path':56B 'patient':20B,35B,41B,46B,51B 'patient-port':19B 'portal':21B,36B 'read':49B 'runtim':22B 'self':24B 'self-host':23B 'signatur':54B 'templat':58B","search_c":"'8.3.0':61C 'allow':74C 'api':72C 'attack':86C 'authent':75C 'author':64C 'bodi':105C 'bypass':65C 'consent':104C 'contain':62C 'criteria':85C 'data':111C 'denialreason':93C 'document':81C 'empti':89C 'equal':91C 'expos':103C 'file':107C 'filter':102C 'isnotlik':94C 'lock':101C 'onsitedocu':71C 'openemr':59C 'overrid':83C 'paramet':95C 'path':108C 'patient':69C,76C,80C,98C 'pid':90C 'portal':70C 'queri':84C 'read':78C 'remov':97C 'scope':99C 'send':88C 'signatur':106C 'templat':110C 'vulner':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-08-18T09:08:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124485","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124485","severity":null,"published_at":"2026-11-08T14:18:17+00:00","modified_at":"2026-11-08T14:18:17+00:00","first_seen_at":"2026-11-08T14:48:41+00:00","fetched_at":"2026-11-08T14:48:41+00:00","note":null}],"documents":[{"id":102158,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-v688-m84c-5h4v","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-18T09:08:36+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102159,"url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-cross-patient-document-disclosure-via-onsite-documents-api","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}