Insecure Direct Object Reference in OpenEMR Affects Patient Settings
CVE-2026-124475

7.1HIGH

Key Information:

Vendor

Openemr

Status
Openemr
Vendor
CVE Published:
8 November 2026

What is CVE-2026-124475?

An insecure direct object reference vulnerability exists in OpenEMR versions prior to 8.3.0. This flaw enables authenticated portal patients to manipulate the settings of other patients by providing arbitrary values for the 'setting_patient' parameter in portal/lib/persist.php. Through this exploitation, malicious users can update patient_settings rows to hinder notifications, alter consent flags, or modify portal preferences, potentially compromising patient privacy and security.

Affected Version(s)

openemr 0 < 8.3.0

openemr 8.3.0

References

https://github.com/openemr/openemr/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/openemr-before-8.3.0...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

andrejtomci
kojiromike
.