Authorization Bypass Vulnerability in OpenEMR Patient Portal API

CVE-2026-124485

What is CVE-2026-124485?

OpenEMR before version 8.3.0 has an authorization bypass flaw in the patient portal onsitedocuments API, enabling authenticated patients to access documents belonging to other patients. This vulnerability arises from the ability to manipulate query parameters, such as empty pid_Equals and denialReason_IsNotLike. By doing so, unauthorized users can circumvent patient-specific restrictions, revealing sensitive information including consent forms, signatures, and file paths. It's crucial for users of affected versions to apply updates to mitigate this risk.

References