---
id: CVE-2026-124447
title: OpenEMR before 8.3.0 IDOR via OnsitePortalActivityController Update Endpoint
summary: >-
  OpenEMR before 8.3.0 contains an insecure direct object reference
  vulnerability in OnsitePortalActivityController::Update() that checks the
  request's patientId instead of the stored record's owner. Authenticated portal
  patients can send …
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: openemr
product: openemr
affected:
  - openemr < 8.3.0
published: '2026-11-08'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T13:15:39.588Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-124447'
references:
  - url: 'https://github.com/openemr/openemr/security/advisories/GHSA-x8rm-m66w-qhh5'
    label: GitHub Security Advisory (GHSA-x8rm-m66w-qhh5)
  - url: 'https://github.com/openemr/openemr/security/advisories/GHSA-5hx3-92fw-6jm6'
    label: GitHub Security Advisory (GHSA-5hx3-92fw-6jm6)
  - url: >-
      https://www.vulncheck.com/advisories/openemr-before-8.3.0-idor-via-onsiteportalactivitycontroller-update-endpoint
    label: >-
      VulnCheck Advisory: OpenEMR before 8.3.0 IDOR via
      OnsitePortalActivityController Update Endpoint
tags:
  - cve.org
ingestedAt: '2026-11-08T13:50:34.976Z'
---

## Overview

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsitePortalActivityController::Update() that checks the request's patientId instead of the stored record's owner. Authenticated portal patients can send PUT requests to the onsiteportalactivity API with another patient's activity id and their own patientId to disclose tableArgs and checksum data, overwrite narratives and status, and take ownership of the record.

## Affected

- `openemr < 8.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.