CVE-2026-124477: OpenEMR before 8.3.0 Missing Authorization via delete_Recall in save.php

Published Nov 8, 2026

Updated

OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete arbitrary patient recall records via the deleteRecall action. Attackers can send POST requests to /interface/main/messages/save.php with a target pid and rID to remove recall data without ACL or ownership checks.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenEMR to a version that resolves this vulnerability.
Fixed in 8.3.0

Event History

Nov 8, 2026

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated OpenEMR user with low privileges can exploit it. The attacker does not need ownership of the targeted patient recall record or the relevant ACL permissions.

What access and request details are required for exploitation?

An attacker needs valid OpenEMR credentials and the ability to send a POST request to /interface/main/messages/save.php using the delete_Recall action. The request supplies the target patient ID (pid) and recall record ID (r_ID).

Are systems running the fixed version affected?

The issue affects OpenEMR versions before 8.3.0. Systems running 8.3.0 or later are not identified as affected by the provided information.

How can administrators investigate possible exploitation?

Review POST requests to /interface/main/messages/save.php that invoke delete_Recall, particularly requests made by low-privileged accounts. Correlate supplied pid and r_ID values with deleted patient recall records and the accounts that submitted the requests.

CVE-2026-124477: OpenEMR before 8.3.0 Missing Authorization via delete_Recall in save.php

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What access and request details are required for exploitation?

Are systems running the fixed version affected?

How can administrators investigate possible exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access and request details are required for exploitation?

Are systems running the fixed version affected?

How can administrators investigate possible exploitation?