Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-124484: OpenEMR before 8.4.0 lets logged-in users view other patients' documents
CVE-2026-124484 · published today
Summary
In versions of OpenEMR released before 8.4.0, a gap in permission checks lets anyone who can log into the system see and change documents that belong to other patients. This could expose personal health information and allow unauthorized edits. Upgrade to version 8.4.0 or later, or apply the vendor's recommended patch, to restore proper access controls.
Original advisory text
OpenEMR before 8.4.0 Missing Authorization in Portal Onsite-Document APIs
OpenEMR before 8.4.0 contains a missing authorization vulnerability in portal onsite-document APIs that allows any authenticated core user to access cross-patient documents. Attackers can omit the patientId parameter and supply arbitrary record IDs to list, read, and overwrite other patients' portal documents, signatures, and template data.
References
- https://github.com/openemr/openemr/security/advisories/GHSA-4r76-rq83-hgpg Vendor Advisory
- https://www.vulncheck.com/advisories/openemr-before-8.4.0-missing-authorization-... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/124xxx/CVE-2026-1244... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-124484 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Severity
9.4
Critical
Type
CWE-862Missing Authorization
Timeline
Published8 Nov 2026
Updated9 Nov 2026
First seen8 Nov 2026
Track software like this
Free during beta