CVE-2026-124476

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description An insecure direct object reference exists in the portal/lib/paylib.php file. The system writes the request-supplied form pid or patient id cc (used in Sphere data) to the onsite portal activity table without verifying it against the current session patient. This allows authenticated portal patients to submit requests via portal-save, review-save, AuthorizeNet, Stripe, or Sphere to insert or modify forged payment-audit records within the billing records of other patients.

Recommendations Update to version 8.3.0 or later.