Insecure Direct Object Reference Vulnerability in OpenEMR by OpenEMR

CVE-2026-124476

What is CVE-2026-124476?

OpenEMR versions prior to 8.3.0 are susceptible to an insecure direct object reference vulnerability located in the portal/lib/paylib.php file. This issue allows authenticated portal patients to exploit the application by submitting specially crafted requests that insert or modify unauthorized payment-audit records associated with other patients' billing information. The vulnerability arises from the lack of validation for the request-supplied 'form_pid' or 'patient_id_cc' values against the session patient, potentially leading to significant implications for patient privacy and data integrity.

References