CVE-2026-124447 OpenEMR before 8.3.0 IDOR via OnsitePortalActivityController Update Endpoint
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-124447?
CVE-2026-124447 is a high-severity vulnerability in openemr, published on 8 Nov 2026.
Official description
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsitePortalActivityController::Update() that checks the request's patientId instead of the stored record's owner. Authenticated portal patients can send PUT requests to the onsiteportalactivity API with another patient's activity id and their own patientId to disclose tableArgs and checksum data, overwrite narratives and status, and take ownership of the record.
Weakness: CWE-639
Which versions are affected by CVE-2026-124447?
How do I fix CVE-2026-124447?
No fix has been published for CVE-2026-124447 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-124447 being exploited?
There is no known exploitation of CVE-2026-124447 in the wild and no public exploit code.
Sources
Also known as GHSA-prmv-76ff-f3xm.