Insecure Direct Object Reference in OpenEMR Patient Portal Payment Process
CVE-2026-33931
What is CVE-2026-33931?
OpenEMR, a widely-used open source electronic health records and medical practice management application, contains an Insecure Direct Object Reference (IDOR) vulnerability prior to version 8.0.0.3. This issue exists in the patient portal payment page, where authenticated users can manipulate the recid query parameter in portal/portal_payment.php to gain unauthorized access to other patients' payment records, including sensitive invoice and billing data as well as payment card information. The vulnerability poses a significant risk to patient privacy and data security, making it critical for users to upgrade to the patched version 8.0.0.3 to mitigate this risk.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
openemr < 8.0.0.3