---
id: CVE-2026-124460
title: OpenEMR before 8.3.0 IDOR in Patient Portal PortalPatientController
summary: >-
  OpenEMR before 8.3.0 contains an insecure direct object reference
  vulnerability in PortalPatientController::Read() that allows authenticated
  patients to read other patients' pending demographic change requests.
  Attackers can supply anoth…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: openemr
product: openemr
affected:
  - openemr < 8.3.0
published: '2026-11-08'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T13:15:47.865Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-124460'
references:
  - url: 'https://github.com/openemr/openemr/security/advisories/GHSA-rw79-jfg7-fgpm'
    label: GitHub Security Advisory (GHSA-rw79-jfg7-fgpm)
  - url: >-
      https://www.vulncheck.com/advisories/openemr-before-8.3.0-idor-in-patient-portal-portalpatientcontroller
    label: >-
      VulnCheck Advisory: OpenEMR before 8.3.0 IDOR in Patient Portal
      PortalPatientController
tags:
  - cve.org
ingestedAt: '2026-11-08T13:50:34.969Z'
---

## Overview

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in PortalPatientController::Read() that allows authenticated patients to read other patients' pending demographic change requests. Attackers can supply another patient's ID in the patientId query string parameter to retrieve PHI including names, addresses, SSNs, and insurance information.

## Affected

- `openemr < 8.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.