Insecure Direct Object Reference in OpenEMR Affecting Patient Data

CVE-2026-124459

What is CVE-2026-124459?

OpenEMR prior to version 8.3.0 exhibits an insecure direct object reference vulnerability. This issue occurs in several encounter-form view and save endpoints that do not properly validate ownership of patient encounters. Authenticated clinical users, with malicious intent, can exploit this weakness by enumerating sequential form IDs in endpoints such as soap/view.php and save.php. This could lead to unauthorized reading, modification, or overwriting of other patients' clinical records, thereby compromising patient privacy and integrity of healthcare data.

References