CVE-2026-124471

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description An authorization flaw exists in the 'interface/billing/sl eob invoice.php' endpoint. This issue allows any authenticated user to access and alter billing information for any encounter. By iterating the id parameter, an attacker can retrieve patient names and billing notes, as well as submit payments, adjustments, deletions, or billing notes to any patient account.

Recommendations Update to version 8.3.0 or later. Restrict access to the 'interface/billing/sl eob invoice.php' endpoint to authorized personnel only.