Authorization Flaws in OpenEMR Affecting Patient Records

CVE-2026-124456

What is CVE-2026-124456?

OpenEMR prior to version 8.3.0 suffers from significant vulnerabilities in the oe-module-prior-authorizations. These missing authorization checks and insecure direct object reference issues enable authenticated low-privilege users to gain access to and manipulate other patients' records. Attackers can exploit this flaw to access sensitive information, such as patients' names, medical record numbers, insurance details, and prior authorization data, through targeted requests. Furthermore, they can use arbitrary ID values in their requests to alter prior-authorization records of other patients, potentially leading to serious breaches of privacy and trust.

References