CVE-2026-124455: OpenEMR before 8.3.0 IDOR via Portal OnsiteDocument Pid_Equals Mass-Assignment

Published Nov 8, 2026

Updated

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query() that allows authenticated portal patients to read other patients' documents by overriding PidEquals criteria. Attackers can supply PidEquals, PidGreaterThan, or PidIn request parameters to the onsitedocuments API to retrieve signed consent forms, signatures, and PHI of any patient.

Event History

Nov 8, 2026

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated portal patient can exploit it. The attacker does not need user interaction and can target records belonging to other patients.

What access is required and which API parameters are involved?

The attacker needs portal-patient authentication and can submit Pid_Equals, Pid_GreaterThan, or Pid_In parameters to the onsitedocuments API. These parameters can override patient-ID filtering criteria.

What information could be exposed?

Successful exploitation can disclose other patients' documents, including signed consent forms, signatures, and protected health information (PHI).

Which versions are affected?

OpenEMR versions before 8.3.0 are affected.

CVE-2026-124455: OpenEMR before 8.3.0 IDOR via Portal OnsiteDocument Pid_Equals Mass-Assignment

Event History

Frequently Asked Questions

Who can exploit this issue?

What access is required and which API parameters are involved?

What information could be exposed?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access is required and which API parameters are involved?

What information could be exposed?

Which versions are affected?