Broken Access Control in OpenEMR Affects Patient Billing Management

CVE-2026-124489

What is CVE-2026-124489?

A vulnerability has been identified in OpenEMR before version 8.3.0, where low-privilege authenticated users can exploit broken access control in the portal_payment.php file. This weakness allows attackers to manipulate patient identifiers, such as pid and form_pid parameters, enabling them to bypass necessary billing access control checks. Consequently, this can lead to unauthorized viewing of payment pages and fraudulent recording of payment receipts for any patient, thereby compromising the integrity of billing records and patient data.

References