CVE-2026-124470: OpenEMR before 8.3.0 BOLA via portal_custom_report.php Exposes Patient Problem Lists

Published Nov 8, 2026

Updated

OpenEMR before 8.3.0 contains a broken object level authorization vulnerability in portal/report/portalcustomreport.php that allows authenticated portal patients to read other patients' problem list entries. Attackers can enumerate sequential IDs in issue parameter names to retrieve other patients' problem titles, clinical notes, ICD diagnosis codes, and IPPF contraceptive records.

Event History

Nov 8, 2026

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated OpenEMR portal patient can exploit it. No user interaction is required, and the attack can be performed remotely.

What information could be exposed?

An attacker can retrieve other patients' problem list entries by enumerating sequential issue_ parameter IDs. Exposed data may include problem titles, clinical notes, ICD diagnosis codes, and IPPF contraceptive records.

Which installations are affected?

OpenEMR versions before 8.3.0 are affected. The vulnerable endpoint is portal/report/portal_custom_report.php.

How can defenders check for attempted exploitation?

Review requests to portal/report/portal_custom_report.php for issue_ parameter values, particularly patterns of sequentially changing IDs from authenticated portal-patient sessions.

CVE-2026-124470: OpenEMR before 8.3.0 BOLA via portal_custom_report.php Exposes Patient Problem Lists

Event History

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Which installations are affected?

How can defenders check for attempted exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Which installations are affected?

How can defenders check for attempted exploitation?