{"id":"CVE-2026-124460","title":"OpenEMR before 8.3.0 IDOR in Patient Portal PortalPatientController","summary":"OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in PortalPatientController::Read() that allows authenticated patients to read other patients' pending demographic change requests. Attackers can supply anoth…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-639"],"vendor":"openemr","product":"openemr","affected":["openemr < 8.3.0"],"published":"2026-11-08","updated":"2026-11-08","sourceUpdated":"2026-11-08T13:15:47.865Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-124460","references":[{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-rw79-jfg7-fgpm","label":"GitHub Security Advisory (GHSA-rw79-jfg7-fgpm)"},{"url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-idor-in-patient-portal-portalpatientcontroller","label":"VulnCheck Advisory: OpenEMR before 8.3.0 IDOR in Patient Portal PortalPatientController"}],"tags":["cve.org"],"ingestedAt":"2026-11-08T13:50:34.969Z","slug":"CVE-2026-124460","body":"## Overview\n\nOpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in PortalPatientController::Read() that allows authenticated patients to read other patients' pending demographic change requests. Attackers can supply another patient's ID in the patientId query string parameter to retrieve PHI including names, addresses, SSNs, and insurance information.\n\n## Affected\n\n- `openemr < 8.3.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}