CVE-2026-124478

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description An authorization flaw exists in the addRecall action of the '/interface/main/messages/save.php' endpoint. This allows authenticated users with low privileges to modify recall data for arbitrary patients. An attacker can overwrite records of patients they are not authorized to access by submitting a crafted new pid along with recall, contact, provider, facility, and notification preference fields.

Recommendations Update to version 8.3.0 or later. As a temporary mitigation, restrict access to the '/interface/main/messages/save.php' endpoint for low-privileged users.