CVE-2026-124456High· 7.1▾ TwilightOpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the oe-module-prior-authorizations module that allow authenticated low-privilege users to access and modify other patients' recor…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the oe-module-prior-authorizations module that allow authenticated low-privilege users to access and modify other patients' records. Attackers can request public/reports/list_report.php to view all patients' names, MRNs, insurance and prior-auth data, or submit arbitrary id values to public/index.php to overwrite other patients' prior-authorization records.
openemr < 8.3.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-124461High· 8.1OpenEMR before 8.3.0 IDOR via DICOM library/ajax/upload.php Endpoint
CVE-2026-124472High· 8.1OpenEMR before 8.3.0 Missing Authorization via sl_eob_patient_note.php
CVE-2026-124477High· 8.8OpenEMR before 8.3.0 Missing Authorization via delete_Recall in save.php
CVE-2026-124478Medium· 6.5OpenEMR before 8.3.0 Missing Authorization via addRecall in save.php
CVE-2026-124480High· 8.8OpenEMR before 8.4.0 Authorization Bypass via FHIR QuestionnaireResponse APICSRFTOKEN
CVE-2026-124486High· 8.8OpenEMR before 8.3.0 Missing Authorization in Classic Document Controller