Missing Authorization Vulnerability in OpenEMR by OpenEMR

CVE-2026-124472

What is CVE-2026-124472?

OpenEMR versions prior to 8.3.0 are susceptible to a missing authorization vulnerability in the 'sl_eob_patient_note.php' module. This flaw permits any authenticated user to access and alter patient billing notes, compromising sensitive billing information. Attackers can leverage low-privilege accounts to exploit the patient_id parameter, utilizing embedded CSRF tokens in POST requests to manipulate confidential data. It is critical for users of affected versions to promptly apply security updates to mitigate this risk.

References