CVE-2026-124455

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description An insecure direct object reference exists in the OnsiteDocumentController::Query() function. Authenticated portal patients can access documents belonging to other patients by overriding the Pid Equals criteria. By supplying the Pid Equals, Pid GreaterThan, or Pid In parameters to the 'onsitedocuments' API endpoint, an attacker can retrieve protected health information (PHI), signatures, and signed consent forms of any patient.

Recommendations Update to version 8.3.0 or later. Restrict the use of the Pid Equals, Pid GreaterThan, and Pid In parameters in the 'onsitedocuments' API endpoint as a temporary mitigation.