Insecure Direct Object Reference in OpenEMR Affects Patient Document Security

CVE-2026-124462

What is CVE-2026-124462?

OpenEMR versions prior to 8.3.0 are susceptible to an insecure direct object reference vulnerability in the OnsiteDocumentController::Query() method. This flaw enables authenticated portal patients to circumvent the lowercase 'pid' authorization check by manipulating the Pid parameter to uppercase. By doing so, attackers can craft requests to the api/onsitedocuments endpoint, altering the session-pinned criteria. Consequently, this vulnerability permits unauthorized access to other patients' sensitive onsite documents, which may contain protected health information (PHI).

References