Missing Authorization Vulnerability in OpenEMR from OpenEMR

CVE-2026-124471

What is CVE-2026-124471?

OpenEMR versions before 8.3.0 are susceptible to a missing authorization vulnerability located in interface/billing/sl_eob_invoice.php. This flaw permits any authenticated user to bypass restrictions, allowing unauthorized access to sensitive billing information of any patient. Attackers can manipulate the 'id' parameter to extract names and billing notes, and perform unauthorized actions such as posting payments, modifications, deletions, or adding notes to any patient's account, thereby compromising patient confidentiality and data integrity.

References