CVE-2026-124489

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description Broken access control in the 'portal/portal payment.php' endpoint allows authenticated users with low privileges to bypass billing Access Control List (ACL) checks. By tampering with the pid and form pid parameters, an attacker can view payment pages and record fraudulent payment receipts for arbitrary patients, leading to the corruption of billing records.

Recommendations Update to version 8.3.0 or later. As a temporary mitigation, restrict access to the 'portal/portal payment.php' endpoint or avoid using the pid and form pid parameters until the update is applied.