CVE-2026-124486

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description An authorization flaw in the classic document controller allows authenticated users with low privileges to recategorize documents belonging to other patients. An attacker can use the move action process function to move a document into a patients|demo category and subsequently retrieve it by providing an empty patient id variable. This process enables the exfiltration of Protected Health Information (PHI) and the tampering of patient charts.

Recommendations Update to version 8.3.0 or later.