PT-2026-139994

CVE-2026-124481

Published

2026-11-08

Updated

2026-11-08

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.4.0

Description An improper authorization issue exists in the Rainforest patient portal payments. The system trusts values supplied by the browser instead of deriving them from the portal session. Authenticated portal patients can manipulate the JSON data sent to the 'portal payment.rainforest.php' endpoint. This allows the payin.authorized webhook to record forged ar activity credits to encounters belonging to other patients, potentially exceeding the actual amount paid.

Recommendations Update to version 8.4.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-639: Authorization Bypass Through User-Controlled Key

Related identifiers

CVE-2026-124481