Broken Object-Level Authorization in OpenEMR by OpenEMR

CVE-2026-124473

What is CVE-2026-124473?

OpenEMR prior to version 8.3.0 is susceptible to a broken object-level authorization vulnerability within the SOAP note update API. This flaw allows authenticated users who possess encounters/notes permissions to make PUT requests to the specified API endpoint with a SOAP note ID that does not belong to the corresponding patient and encounter. As a result, malicious actors can overwrite clinical notes, posing a significant risk to the integrity of patient data by potentially reassigning clinical notes to unauthorized patient records.

References