CVE-2026-124447: OpenEMR before 8.3.0 IDOR via OnsitePortalActivityController Update Endpoint

Published Nov 8, 2026

Updated

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsitePortalActivityController::Update() that checks the request's patientId instead of the stored record's owner. Authenticated portal patients can send PUT requests to the onsiteportalactivity API with another patient's activity id and their own patientId to disclose tableArgs and checksum data, overwrite narratives and status, and take ownership of the record.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenEMR to a version that resolves this vulnerability.
Fixed in 8.3.0

Event History

Nov 8, 2026

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated OpenEMR portal patient can exploit it. The attacker needs their own valid patientId and the activity ID of another patient's onsite portal activity record.

What access and impact does exploitation provide?

The attacker can send a PUT request to the onsiteportalactivity API using another patient's activity ID with their own patientId. This can disclose the target record's tableArgs and checksum data, change its narrative and status, and reassign ownership of the record.

Which deployments are affected?

OpenEMR versions before 8.3.0 are affected. The issue is in the OnsitePortalActivityController Update endpoint, so exposure requires portal-patient authentication and access to the onsiteportalactivity API.

How can I determine whether an activity record may have been altered or reassigned?

Review onsite portal activity records for unexpected narrative or status changes and for ownership that does not match the patient associated with the record. Also investigate PUT requests to the onsiteportalactivity API where the request patientId differs from the stored record owner's patient identity.

CVE-2026-124447: OpenEMR before 8.3.0 IDOR via OnsitePortalActivityController Update Endpoint

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What access and impact does exploitation provide?

Which deployments are affected?

How can I determine whether an activity record may have been altered or reassigned?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access and impact does exploitation provide?

Which deployments are affected?

How can I determine whether an activity record may have been altered or reassigned?