GHSA-jvhx-fg6j-8c9x: OpenEMR before 8.3.0 IDOR via portal/lib/persist.php setting_patient
Published Nov 8, 2026
·Updated
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authenticated portal patients to modify other patients' settings by supplying an arbitrary settingpatient value. Attackers can insert or overwrite patientsettings rows for victims to suppress notifications, tamper with consent flags, or alter portal preferences.
Affected Software
1 affected component
OpenEMR OpenEMR<8.3.0
Event History
Nov 8, 2026
CVE Published
via OSV·01:15 PM
Data Sourced
via OSV·01:15 PM
DescriptionSeverityWeakness