CVE-2026-124473: OpenEMR before 8.3.0 Broken Object Authorization via SOAP Note Update API

Published Nov 8, 2026

Updated

OpenEMR before 8.3.0 contains a broken object-level authorization vulnerability in the SOAP note update API, which does not verify that the supplied SOAP note ID (sid) belongs to the supplied patient and encounter. Authenticated users with encounters/notes permission can send PUT requests to /api/patient/:pid/encounter/:eid/soapnote/:sid with another patient's sid to overwrite that clinical note and reassign its pid.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenEMR to a version that resolves this vulnerability.
Fixed in 8.3.0

Event History

Nov 8, 2026

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users can exploit this issue?

An attacker must be authenticated and have encounters/notes permission. No user interaction is required, and the vulnerable API endpoint is reachable over the network.

What does an attacker need to know or control?

The attacker needs to issue a PUT request to the SOAP note update endpoint using a SOAP note ID belonging to a different patient than the patient and encounter supplied in the request. The API fails to verify that the note ID belongs to those supplied records.

What is the impact of successful exploitation?

An authorized but insufficiently restricted user can overwrite another patient's clinical SOAP note and reassign that note's patient ID. The provided severity vector indicates integrity impact is high and availability impact is low, with no confidentiality impact listed.

How can I tell whether my deployment is affected?

OpenEMR versions before 8.3.0 are affected. Review SOAP note update activity for PUT requests to /api/patient/:pid/encounter/:eid/soap_note/:sid where the SOAP note ID does not belong to the specified patient and encounter.

CVE-2026-124473: OpenEMR before 8.3.0 Broken Object Authorization via SOAP Note Update API

Remediation

Event History

Frequently Asked Questions

Which users can exploit this issue?

What does an attacker need to know or control?

What is the impact of successful exploitation?

How can I tell whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What does an attacker need to know or control?

What is the impact of successful exploitation?

How can I tell whether my deployment is affected?