CVE-2026-124476: OpenEMR before 8.3.0 IDOR via form_pid in portal/lib/paylib.php

Published Nov 8, 2026

Updated

OpenEMR before 8.3.0 contains an insecure direct object reference in portal/lib/paylib.php, which writes the request-supplied formpid (or the patientidcc value in Sphere data) to onsiteportalactivity without checking it against the session patient. Authenticated portal patients can submit portal-save, review-save, AuthorizeNet, Stripe, or Sphere requests to insert or modify forged payment-audit records in other patients' billing records.

Event History

Nov 8, 2026

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated portal patient can exploit it. The attacker must be able to send one of the affected portal request types and supply a forged patient identifier.

Which portal actions are affected?

The affected requests are portal-save, review-save, AuthorizeNet, Stripe, and Sphere. For Sphere data, the attacker can use the patient_id_cc value; other affected paths use form_pid.

What is the impact of successful exploitation?

An attacker can insert or modify payment-audit records in another patient's billing records. The described impact is integrity-related; no confidentiality or availability impact is stated.

Are installations before version 8.3.0 affected by default?

The issue affects OpenEMR versions before 8.3.0, but the available data does not state whether every default installation exposes the affected portal payment request paths.

CVE-2026-124476: OpenEMR before 8.3.0 IDOR via form_pid in portal/lib/paylib.php

Event History

Frequently Asked Questions

Who can exploit this issue?

Which portal actions are affected?

What is the impact of successful exploitation?

Are installations before version 8.3.0 affected by default?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which portal actions are affected?

What is the impact of successful exploitation?

Are installations before version 8.3.0 affected by default?