---
id: "CVE-2026-124485"
page: "https://infrastack.ai/live/CVE-2026-124485"
kind: "vulnerability"
aliases: ["CVE-2026-124485"]
title: "OpenEMR: patient portal API lets patients read other patients' documents"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["healthcare", "openemr", "patient-portal", "runtime", "self-hosted"]
not_affected_if: ["patient-portal-disabled", "version-8.3.0-or-later"]
published_at: "2026-11-08T14:18:17+00:00"
first_seen_at: "2026-11-08T14:48:41+00:00"
updated_at: "2026-11-08T14:49:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124485", "first_seen_at": "2026-11-08T14:48:41+00:00"}]
exploit_sources: []
---

# OpenEMR: patient portal API lets patients read other patients' documents

Link for people: https://infrastack.ai/live/CVE-2026-124485 (this .md is for agents)

OpenEMR before 8.3.0 has an authorization bypass in the patient portal onsitedocuments API. An authenticated patient can blank out the patient filter and read other patients' consent forms, signatures, file paths and templates.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OpenEMR version against `8.3.0`; anything earlier is in range.

## Fix

- OpenEMR: upgrade to `8.3.0` or later.

## Timeline

- 2026-11-08T14:48:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124485

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openemr/openemr/security/advisories/GHSA-v688-m84c-5h4v
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openemr-before-8.3.0-cross-patient-document-disclosure-via-onsite-documents-api

## From the sources

OpenEMR before 8.3.0 contains an authorization bypass vulnerability in the patient portal onsitedocuments API that allows authenticated patients to read other patients' documents by overriding query criteria. Attackers can send empty pid_Equals and denialReason_IsNotLike parameters to remove patient scoping and locked filters, exposing consent bodies, signatures, file paths, and template data.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_