CVE-2026-124488

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description An authorization bypass allows authenticated clinicians who lack high-sensitivity permissions to read and modify encounter-bound forms. This is achieved by accessing the 'load form.php' endpoint to obtain restricted content and a CSRF token via the Clinical Notes or Care Plan direct loader, followed by submitting data to the 'save.php' endpoint to tamper with clinical records.

Recommendations Update to version 8.3.0 or later. Restrict access to the 'load form.php' and 'save.php' endpoints for users without high-sensitivity permissions.