PT-2026-139998
CVE-2026-124485
·
Published
2026-11-08
·
Updated
2026-11-08
Description by
CVSS 3.1
6.5
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
OpenEMR before 8.3.0 contains an authorization bypass vulnerability in the patient portal onsitedocuments API that allows authenticated patients to read other patients' documents by overriding query criteria. Attackers can send empty pid Equals and denialReason IsNotLike parameters to remove patient scoping and locked filters, exposing consent bodies, signatures, file paths, and template data.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾