CVE-2026-124455

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query() that allows authenticated portal patients to read other patients' documents by overriding Pid Equals criteria. Attackers can supply Pid Equals, Pid GreaterThan, or Pid In request parameters to the onsitedocuments API to retrieve signed consent forms, signatures, and PHI of any patient.