Authorization Flaw in OpenEMR Affects Patient Data Integrity

CVE-2026-124461

What is CVE-2026-124461?

OpenEMR prior to version 8.3.0 has a significant missing authorization vulnerability within the library/ajax/upload.php file. This flaw allows authenticated users, particularly low-privileged ones, to exploit the system by providing arbitrary document IDs (doc_id), enabling them to read and overwrite sensitive document data. This could lead to the unauthorized disclosure of patient health information and manipulation of medical records across all patients. Users can enumerate doc_id values through existing fetch and save actions, thus posing a serious risk to data integrity and patient privacy.

References