CVE-2026-124478: OpenEMR before 8.3.0 Missing Authorization via addRecall in save.php
OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.php that allows low-privileged authenticated users to modify arbitrary patients' recall data. Attackers can submit a crafted newpid with recall, contact, provider, facility, and notification preference fields to overwrite records of patients they cannot access.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with low privileges can exploit it. The attacker must be able to submit requests to the addRecall action in /interface/main/messages/save.php.
What access or data can an attacker change?
The issue lets an attacker modify recall data for arbitrary patients, including patients they are not authorized to access. Crafted requests can overwrite recall, contact, provider, facility, and notification preference fields.
Which versions are affected?
OpenEMR versions before 8.3.0 are affected. Upgrading to 8.3.0 or later addresses the affected version range described.