CVE-2026-124486: OpenEMR before 8.3.0 Missing Authorization in Classic Document Controller

Published Nov 8, 2026

Updated

OpenEMR before 8.3.0 contains a missing authorization vulnerability in the classic document controller that allows low-privilege authenticated users to recategorize other patients' documents. Attackers can invoke moveactionprocess to move a document into a patients|demo category, then retrieve it with an empty patientid to exfiltrate PHI and tamper with charts.

Event History

Nov 8, 2026

CVE Published

via MITRE·01:16 PM

Data Sourced

via MITRE·01:16 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A low-privilege authenticated OpenEMR user can exploit it. No user interaction is required.

What access does exploitation provide?

An attacker can recategorize documents belonging to other patients, retrieve documents using an empty patient_id, exfiltrate PHI, and tamper with patient charts.

Which component and action are involved?

The issue affects the classic document controller. Exploitation involves invoking move_action_process to move a document into a patients|demo category.

Which versions are affected?

OpenEMR versions before 8.3.0 are affected.

CVE-2026-124486: OpenEMR before 8.3.0 Missing Authorization in Classic Document Controller

Event History

Frequently Asked Questions

Who can exploit this issue?

What access does exploitation provide?

Which component and action are involved?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access does exploitation provide?

Which component and action are involved?

Which versions are affected?