CVE-2026-124460: OpenEMR before 8.3.0 IDOR in Patient Portal PortalPatientController

Published Nov 8, 2026

Updated

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in PortalPatientController::Read() that allows authenticated patients to read other patients' pending demographic change requests. Attackers can supply another patient's ID in the patientId query string parameter to retrieve PHI including names, addresses, SSNs, and insurance information.

Event History

Nov 8, 2026

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated patient who can access the OpenEMR patient portal can exploit it. The attacker needs to provide another patient's ID through the patientId query-string parameter.

What information could be exposed?

The issue can expose other patients' pending demographic change requests containing PHI, including names, addresses, Social Security numbers, and insurance information.

Which versions are affected?

OpenEMR versions before 8.3.0 are affected. The provided information identifies 8.3.0 as the version boundary for this issue.

CVE-2026-124460: OpenEMR before 8.3.0 IDOR in Patient Portal PortalPatientController

Event History

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Which versions are affected?