GHSA-j347-wp33-79q9: OpenEMR before 8.3.0 Missing Authorization via addRecall in save.php

Q: Who can exploit this issue?

A low-privileged authenticated OpenEMR user can exploit it. The attacker does not need access to the targeted patient's record, but must be able to submit requests to the affected addRecall action.

Q: What data can be changed through exploitation?

An attacker can overwrite recall data for arbitrary patients by supplying a crafted new_pid. The affected fields include recall, contact, provider, facility, and notification preferences.

Q: Which versions are affected?

OpenEMR versions before 8.3.0 are affected. Upgrading to 8.3.0 or later addresses the affected version range described in the advisory.

Published Nov 8, 2026

Updated

OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.php that allows low-privileged authenticated users to modify arbitrary patients' recall data. Attackers can submit a crafted newpid with recall, contact, provider, facility, and notification preference fields to overwrite records of patients they cannot access.

Affected Software

1 affected component

OpenEMR OpenEMR<8.3.0

Event History

Nov 8, 2026

CVE Published

via OSV·01:15 PM

Data Sourced

via OSV·01:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A low-privileged authenticated OpenEMR user can exploit it. The attacker does not need access to the targeted patient's record, but must be able to submit requests to the affected addRecall action.

What data can be changed through exploitation?

An attacker can overwrite recall data for arbitrary patients by supplying a crafted new_pid. The affected fields include recall, contact, provider, facility, and notification preferences.

Which versions are affected?

OpenEMR versions before 8.3.0 are affected. Upgrading to 8.3.0 or later addresses the affected version range described in the advisory.

GHSA-j347-wp33-79q9: OpenEMR before 8.3.0 Missing Authorization via addRecall in save.php

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What data can be changed through exploitation?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What data can be changed through exploitation?

Which versions are affected?