CVE-2026-124485: OpenEMR before 8.3.0 Cross-Patient Document Disclosure via Onsite Documents API

Published Nov 8, 2026

Updated

OpenEMR before 8.3.0 contains an authorization bypass vulnerability in the patient portal onsitedocuments API that allows authenticated patients to read other patients' documents by overriding query criteria. Attackers can send empty pidEquals and denialReasonIsNotLike parameters to remove patient scoping and locked filters, exposing consent bodies, signatures, file paths, and template data.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenEMR to a version that resolves this vulnerability.
Fixed in 8.3.0

Event History

Nov 8, 2026

CVE Published

via MITRE·01:16 PM

Data Sourced

via MITRE·01:16 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated patient who can access the patient portal can exploit it. No additional user interaction is required.

Which deployments are affected?

OpenEMR versions before 8.3.0 are affected where the patient portal onsitedocuments API is available to authenticated patients.

What information could be exposed?

The issue can expose other patients' document data, including consent bodies, signatures, file paths, and template data.

How does exploitation work?

An attacker overrides the API query criteria by sending empty pid_Equals and denialReason_IsNotLike parameters, removing patient scoping and locked-document filtering.

CVE-2026-124485: OpenEMR before 8.3.0 Cross-Patient Document Disclosure via Onsite Documents API

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What information could be exposed?

How does exploitation work?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What information could be exposed?

How does exploitation work?