CVE-2026-124460Medium· 6.5▾ SunlitOpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in PortalPatientController::Read() that allows authenticated patients to read other patients' pending demographic change requests. Attackers can supply anoth…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in PortalPatientController::Read() that allows authenticated patients to read other patients' pending demographic change requests. Attackers can supply another patient's ID in the patientId query string parameter to retrieve PHI including names, addresses, SSNs, and insurance information.
openemr < 8.3.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-124447High· 8.1OpenEMR before 8.3.0 IDOR via OnsitePortalActivityController Update Endpoint
CVE-2026-124449Medium· 6.5OpenEMR before 8.4.0 Missing Authorization via FHIR Media and QuestionnaireResponse Routes
CVE-2026-124451Medium· 5.3OpenEMR before 8.4.0 Authorization Bypass via checkUserHasAccessToPatient in SMART on FHIR
CVE-2026-124453High· 7.1OpenEMR before 8.3.0 IDOR in Portal Patient Settings via persist.php
CVE-2026-124455Medium· 6.5OpenEMR before 8.3.0 IDOR via Portal OnsiteDocument Pid_Equals Mass-Assignment
CVE-2026-124459High· 8.1OpenEMR before 8.3.0 Cross-Patient IDOR via Encounter Form Viewers and Save Handlers