CVE-2026-124484

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.4.0

Description An authorization flaw exists in the portal onsite-document APIs. This issue allows an authenticated core user to access documents belonging to other patients. By omitting the patientId parameter and providing arbitrary record IDs, an attacker can list, read, and overwrite portal documents, signatures, and template data of other patients.

Recommendations Update to version 8.4.0 or later. Avoid using the patientId parameter in the portal onsite-document APIs until the update is applied.