CVE-2026-124485

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description An authorization bypass exists in the patient portal 'onsitedocuments' API. Authenticated patients can access documents belonging to other patients by overriding query criteria. This is achieved by sending empty pid Equals and denialReason IsNotLike parameters, which removes patient scoping and locked filters. This exposure can reveal consent bodies, signatures, file paths, and template data.

Recommendations Update to version 8.3.0 or later. As a temporary mitigation, restrict access to the 'onsitedocuments' API endpoint.