PT-2026-139969
CVE-2026-124453
·
Published
2026-11-08
·
Updated
2026-11-08
Description by
CVSS 3.1
7.1
HighMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authenticated portal patients to write settings for other patients. Attackers can modify the setting patient parameter in a JSON POST request to another patient's PID, altering that patient's portal settings such as the portal theme.
Found an issue in the description? Have something to add? Feel free to write us 👾