Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

OpenEMR lets low-level users re-categorize other patients’ records

CVE-2026-124486 · published today
Summary

In versions of OpenEMR released before 8.3.0, a user who can log in but does not have full permissions can change the category of another patient’s document. By moving a file into a public category, the attacker can later view or copy the medical information without proper access rights. Upgrade OpenEMR to version 8.3.0 or later, or apply the vendor’s patch, to stop this behavior.

Original advisory text
OpenEMR before 8.3.0 contains a missing authorization vulnerability in the classic document controller that allows low-privilege authenticated users to recategorize other patients' documents. Attac...
OpenEMR before 8.3.0 contains a missing authorization vulnerability in the classic document controller that allows low-privilege authenticated users to recategorize other patients' documents. Attackers can invoke move_action_process to move a document into a patients|demo category, then retrieve it with an empty patient_id to exfiltrate PHI and tamper with charts.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.7 High
Type
CWE-862Missing Authorization
Timeline
Published8 Nov 2026
Updated8 Nov 2026
First seen8 Nov 2026
Sources
CVE-2026-124486 · NVD
Track software like this
Free during beta