CVE-2026-124489: OpenEMR before 8.3.0 Broken Access Control via portal_payment.php

Published Nov 8, 2026

Updated

OpenEMR before 8.3.0 contains a broken access control vulnerability in portal/portalpayment.php that allows low-privilege authenticated users to bypass billing ACL checks by tampering patient identifiers. Attackers can modify the pid and formpid parameters to view payment pages and record fraudulent payment receipts for arbitrary patients, corrupting billing records.

Event History

Nov 8, 2026

CVE Published

via MITRE·01:16 PM

Data Sourced

via MITRE·01:16 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs a low-privilege authenticated OpenEMR account. The vulnerable payment portal endpoint is network-accessible, and no user interaction is required.

What access does exploitation provide?

By changing the pid and form_pid parameters, an attacker can access payment pages for arbitrary patients and create fraudulent payment receipts. This can expose payment-related information and corrupt billing records.

Which deployments are affected?

OpenEMR versions before 8.3.0 are affected. Deployments where low-privilege users can authenticate and reach portal/portal_payment.php are exposed.

How can administrators look for possible exploitation?

Review payment activity for receipts associated with unexpected patients or created by low-privilege accounts. Investigate requests to portal/portal_payment.php where pid or form_pid values do not correspond to the authenticated user's authorized patient context.

CVE-2026-124489: OpenEMR before 8.3.0 Broken Access Control via portal_payment.php

Event History

Frequently Asked Questions

Who can exploit this issue?

What access does exploitation provide?

Which deployments are affected?

How can administrators look for possible exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access does exploitation provide?

Which deployments are affected?

How can administrators look for possible exploitation?