CVE-2026-124472: OpenEMR before 8.3.0 Missing Authorization via sl_eob_patient_note.php

Published Nov 8, 2026

Updated

OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sleobpatientnote.php that allows any authenticated user to read and modify patient billing notes. Attackers with low-privilege accounts can enumerate the patientid parameter and submit POST requests using the embedded CSRF token to view or tamper with confidential billing data.

Event History

Nov 8, 2026

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated OpenEMR user, including a low-privilege account, can exploit it. The attacker does not need user interaction and can reach the vulnerable endpoint over the network.

What does an attacker need to do to access another patient's billing notes?

The attacker needs a valid authenticated session and the embedded CSRF token. They can enumerate the patient_id parameter and send POST requests to read or modify confidential patient billing notes.

Which deployments are affected?

OpenEMR versions before 8.3.0 are affected. The provided information does not identify any configuration prerequisite beyond having authenticated user access.

How can I tell whether the issue may already have been exploited?

Review requests to interface/billing/sl_eob_patient_note.php for POST activity, particularly where a user accesses or changes billing notes associated with multiple or unexpected patient_id values. The supplied information does not provide specific logging indicators or forensic artifacts.

CVE-2026-124472: OpenEMR before 8.3.0 Missing Authorization via sl_eob_patient_note.php

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do to access another patient's billing notes?

Which deployments are affected?

How can I tell whether the issue may already have been exploited?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do to access another patient's billing notes?

Which deployments are affected?

How can I tell whether the issue may already have been exploited?