CVE-2026-124486 · Package
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.3.0 lets a low-privilege logged-in user recategorize other patients' documents through the classic document controller. An attacker can then retrieve those documents to exfiltrate protected health information and alter charts.
first public Aug 18, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any OpenEMR deployment before 8.3.0 where users hold authenticated accounts, since the flaw requires a logged-in low-privilege user. Clinics and hospitals running self-hosted OpenEMR are the exposed group; instances already on 8.3.0 or later are not affected.
Not affected if no-authenticated-users, version-8.3.0-or-later
Who cares healthcare, openemr, php, self-hosted
version.php in the install directory.8.3.0.8.3.0OpenEMR before 8.3.0 contains a missing authorization vulnerability in the classic document controller that allows low-privilege authenticated users to recategorize other patients' documents. Attackers can invoke move_action_process to move a document into a patients|demo category, then retrieve it with an empty patient_id to exfiltrate PHI and tamper with charts.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.