CVE-2026-124453: OpenEMR before 8.3.0 IDOR in Portal Patient Settings via persist.php

Published Nov 8, 2026

Updated

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authenticated portal patients to write settings for other patients. Attackers can modify the settingpatient parameter in a JSON POST request to another patient's PID, altering that patient's portal settings such as the portal theme.

Event History

Nov 8, 2026

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated portal patient can exploit it. The attacker needs the PID of another patient and can change the setting_patient value in a JSON POST request.

What is the impact on another patient's account?

An attacker can write portal settings for the targeted patient, including settings such as the portal theme. The provided information describes unauthorized modification of settings, not access to other patient data.

Are installations running version 8.3.0 affected?

The issue affects OpenEMR versions before 8.3.0. The provided information does not identify any affected versions at or after 8.3.0.

How can I determine whether exploitation may have occurred?

Review requests to portal/lib/persist.php for JSON POST submissions where setting_patient identifies a PID different from the authenticated portal patient's own PID. The provided information does not specify logging fields or indicators beyond this request manipulation.

CVE-2026-124453: OpenEMR before 8.3.0 IDOR in Portal Patient Settings via persist.php

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the impact on another patient's account?

Are installations running version 8.3.0 affected?

How can I determine whether exploitation may have occurred?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the impact on another patient's account?

Are installations running version 8.3.0 affected?

How can I determine whether exploitation may have occurred?