CVE-2026-124444

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.4.0

Description A mass assignment issue exists in the patient portal OnsiteDocument query API. This flaw allows authenticated users to set bitwise criteria filters through request parameters, which are then inserted unquoted into the SQL WHERE clause. An attacker can perform SQL injection using parameters such as Id BitwiseAnd to access any database table, potentially exposing other patients' records and staff password hashes.

Recommendations Update to version 8.4.0 or later. Avoid using the Id BitwiseAnd parameter in the OnsiteDocument query API until the update is applied.