Broken Object Level Authorization in OpenEMR Affects Patient Privacy

CVE-2026-124470

What is CVE-2026-124470?

OpenEMR prior to version 8.3.0 contains a serious oversight in its authorization checks within the portal/report/portal_custom_report.php file. This flaw allows authenticated portal patients to access sensitive information belonging to other patients, including their problem list entries. Attackers can exploit this weakness by sequentially enumerating IDs in the issue_ parameter, leading to unauthorized retrieval of clinical notes, ICD diagnosis codes, and private contraceptive records. This vulnerability raises critical concerns regarding patient data confidentiality and security within the healthcare sector.

References