Authorization Bypass in OpenEMR by OpenEMR

CVE-2026-124488

What is CVE-2026-124488?

OpenEMR versions prior to 8.3.0 exhibit an authorization bypass vulnerability that compromises the integrity of clinical records. Authenticated clinicians, even without high-sensitivity permissions, can exploit this flaw via load_form.php to read and modify encounter-bound forms. This method allows attackers to directly target Clinical Notes or the Care Plan loader, access restricted content, retrieve a CSRF token, and subsequently manipulate clinical records through save.php, raising substantial security concerns.

References