CVE-2026-124488: OpenEMR before 8.3.0 Authorization Bypass via load_form.php High-Sensitivity Encounters

OpenEMR before 8.3.0 contains an authorization bypass vulnerability that allows authenticated clinicians lacking high-sensitivity permission to read and modify encounter-bound forms via loadform.php. Attackers can request the Clinical Notes or Care Plan direct loader to obtain restricted content and a CSRF token, then submit save.php to tamper with clinical records.