CVE-2026-124475: OpenEMR before 8.3.0 IDOR via portal/lib/persist.php setting_patient

Published Nov 8, 2026

Updated

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authenticated portal patients to modify other patients' settings by supplying an arbitrary settingpatient value. Attackers can insert or overwrite patientsettings rows for victims to suppress notifications, tamper with consent flags, or alter portal preferences.

Event History

Nov 8, 2026

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated OpenEMR portal patient can exploit it. The attacker needs the ability to submit an arbitrary setting_patient value to portal/lib/persist.php.

Are unauthenticated users affected?

The provided information identifies authenticated portal patients as the attacker role. It does not indicate that unauthenticated access can exploit the issue.

What can an attacker change?

An attacker can insert or overwrite patient_settings rows belonging to other patients. This can suppress notifications, tamper with consent flags, or alter portal preferences.

Which versions need remediation?

OpenEMR versions before 8.3.0 are affected according to the available information. Upgrading to 8.3.0 or later addresses the stated affected-version range.

CVE-2026-124475: OpenEMR before 8.3.0 IDOR via portal/lib/persist.php setting_patient

Event History

Frequently Asked Questions

Who can exploit this issue?

Are unauthenticated users affected?

What can an attacker change?

Which versions need remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are unauthenticated users affected?

What can an attacker change?

Which versions need remediation?