CVE-2026-124488 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.3.0 lets an authenticated clinician who lacks high-sensitivity permission read and change encounter forms through load_form.php. The attacker can fetch restricted Clinical Notes or Care Plan content and a CSRF token, then submit save.php to alter clinical records.
first public Aug 18, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any OpenEMR installation before 8.3.0 where clinician accounts can log in. Exposure depends on whether users without high-sensitivity permissions can reach the encounter form loaders. Deployments already on 8.3.0 or later are not affected by this flaw.
Not affected if version-8.3.0-or-later
Who cares healthcare, openemr, self-hosted
8.3.0 are in scope8.3.0 or laterOpenEMR before 8.3.0 contains an authorization bypass vulnerability that allows authenticated clinicians lacking high-sensitivity permission to read and modify encounter-bound forms via load_form.php. Attackers can request the Clinical Notes or Care Plan direct loader to obtain restricted content and a CSRF token, then submit save.php to tamper with clinical records.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.