CVE-2026-124472

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description An authorization flaw exists in the 'interface/billing/sl eob patient note.php' endpoint. This issue allows any authenticated user, including those with low-privilege accounts, to read and modify patient billing notes. An attacker can achieve this by enumerating the patient id parameter and submitting POST requests using the embedded CSRF (Cross-Site Request Forgery) token—a unique value used to prevent unauthorized commands from being transmitted from a user that the web application trusts—to view or tamper with confidential billing data.

Recommendations Update to version 8.3.0. Restrict access to the 'interface/billing/sl eob patient note.php' endpoint to authorized personnel only.