CVE-2026-124462

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description An insecure direct object reference exists in the OnsiteDocumentController::Query() function. Authenticated portal patients can bypass the authorization guard by providing a capitalized Pid parameter. By sending a request to the 'api/onsitedocuments' endpoint with the Pid variable set to another patient's identifier, an attacker can overwrite session-pinned criteria to access and read onsite documents containing Protected Health Information (PHI) belonging to other patients.

Recommendations Update to version 8.3.0 or later. Avoid using the Pid parameter in the 'api/onsitedocuments' endpoint to request data for other users.