CVE-2026-124477

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description Low-privileged authenticated users can delete arbitrary patient recall records due to missing authorization. This occurs when the delete Recall action is used to send POST requests to the '/interface/main/messages/save.php' endpoint. By providing a target pid and r ID, an attacker can remove recall data because the system fails to perform Access Control List (ACL) or ownership checks.

Recommendations Update to version 8.3.0 or later. As a temporary mitigation, restrict access to the '/interface/main/messages/save.php' endpoint or the delete Recall action for low-privileged users.