CVE-2026-124461

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description An authorization flaw exists in the 'library/ajax/upload.php' endpoint. This issue allows any authenticated user to read and overwrite document data by providing an arbitrary doc id. Low-privilege users can utilize the fetch and save actions to enumerate doc id values, leading to the disclosure of patient health information and the unauthorized modification of medical records for all patients.

Recommendations Update to version 8.3.0 or later. As a temporary mitigation, restrict access to the 'library/ajax/upload.php' endpoint or monitor the use of the doc id parameter.