CVE-2026-124456

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description The oe-module-prior-authorizations module contains missing authorization and insecure direct object reference (IDOR) issues. These flaws allow authenticated users with low privileges to access and modify records belonging to other patients. An attacker can access the 'public/reports/list report.php' endpoint to view patient names, Medical Record Numbers (MRNs), insurance, and prior-authorization data. Additionally, by submitting arbitrary id values to the 'public/index.php' endpoint, an attacker can overwrite prior-authorization records of other patients.

Recommendations Update to version 8.3.0 or later. Restrict access to the oe-module-prior-authorizations module as a temporary mitigation.