CVE-2026-124460

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description An insecure direct object reference exists in the PortalPatientController::Read() function. This allows authenticated patients to access pending demographic change requests belonging to other patients. By providing a different patient's ID via the patientId query string parameter, an attacker can retrieve Protected Health Information (PHI), such as names, addresses, Social Security Numbers (SSNs), and insurance details.

Recommendations Update to version 8.3.0 or later. As a temporary mitigation, restrict access to the PortalPatientController::Read() function or the patientId parameter until the update is applied.