CVE-2026-124447

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description An insecure direct object reference exists in the Update() function of the OnsitePortalActivityController. The system validates the patientId provided in the request rather than verifying the actual owner of the stored record. Authenticated portal patients can exploit this by sending PUT requests to the 'onsiteportalactivity' API endpoint using another patient's activity ID and their own patientId. This allows an attacker to disclose tableArgs and checksum data, overwrite narratives and status, and take ownership of the record.

Recommendations Update to version 8.3.0 or later.