CVE-2026-124447
OpenEMR before 8.3.0 IDOR via OnsitePortalActivityController Update Endpoint
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsitePortalActivityController::Update() that checks the request's patientId instead of the stored record's owner. Authenticated portal patients can send PUT requests to the onsiteportalactivity API with another patient's activity id and their own patientId to disclose tableArgs and checksum data, overwrite narratives and status, and take ownership of the record.
| CWE | CWE-639 |
| Vendor | openemr |
| Product | openemr |
| Published | Nov 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for openemr openemr
Be the first to know when new high vulnerabilities affecting openemr openemr are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
openemr / openemr
0 < 8.3.0
References
github.com: https://github.com/openemr/openemr/security/advisories/GHSA-x8rm-m66w-qhh5 github.com: https://github.com/openemr/openemr/security/advisories/GHSA-5hx3-92fw-6jm6 vulncheck.com: https://www.vulncheck.com/advisories/openemr-before-8.3.0-idor-via-onsiteportalactivitycontroller-update-endpoint
Credits
Alpastx MKLKCDG