CVE-2026-124470

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description An issue exists in the 'portal/report/portal custom report.php' endpoint where authenticated portal patients can access problem list entries belonging to other patients. This occurs because of broken object level authorization, allowing attackers to enumerate sequential IDs within the issue parameter to retrieve sensitive data, including problem titles, clinical notes, ICD diagnosis codes, and IPPF contraceptive records.

Recommendations Update to version 8.3.0 or later. As a temporary mitigation, restrict access to the 'portal/report/portal custom report.php' endpoint or avoid using the issue parameter until the update is applied.