CVE-2026-124471: OpenEMR before 8.3.0 Missing Authorization and IDOR via sl_eob_invoice.php

Published Nov 8, 2026

Updated

OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sleobinvoice.php that allows any authenticated user to read and modify billing data for any encounter. Attackers can iterate the id parameter to read patient names and billing notes, and post payments, adjustments, deletions, or billing notes against any patient's account.

Event History

Nov 8, 2026

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated OpenEMR user can exploit it. The attacker does not need interaction from another user and can target billing records for encounters other than their own.

What data and actions are exposed?

An attacker can iterate the id parameter to read patient names and billing notes. They can also modify billing data by posting payments, adjustments, deletions, or billing notes to any patient's account.

Which deployments are affected?

OpenEMR versions before 8.3.0 are affected. The issue is in interface/billing/sl_eob_invoice.php.

CVE-2026-124471: OpenEMR before 8.3.0 Missing Authorization and IDOR via sl_eob_invoice.php

Event History

Frequently Asked Questions

Who can exploit this issue?

What data and actions are exposed?

Which deployments are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What data and actions are exposed?

Which deployments are affected?