Missing Authorization in OpenEMR Affects Patient Data Access

CVE-2026-124478

What is CVE-2026-124478?

OpenEMR versions prior to 8.3.0 contain a vulnerability that allows low-privileged authenticated users to alter recall data for patients they do not have permissions to access. Exploiting this issue, malicious actors can submit specially crafted requests to the addRecall action in the save.php file, enabling them to overwrite sensitive patient records, including recall, contact, provider, facility, and notification preferences. This vulnerability poses a significant risk to the integrity of patient data management and highlights the importance of robust authorization checks in healthcare applications.

References