CVE-2026-124455 OpenEMR before 8.3.0 IDOR via Portal OnsiteDocument Pid_Equals Mass-Assignment
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-124455?
CVE-2026-124455 is a high-severity vulnerability in openemr, published on 8 Nov 2026.
Official description
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query() that allows authenticated portal patients to read other patients' documents by overriding Pid_Equals criteria. Attackers can supply Pid_Equals, Pid_GreaterThan, or Pid_In request parameters to the onsitedocuments API to retrieve signed consent forms, signatures, and PHI of any patient.
Weakness: CWE-639
Which versions are affected by CVE-2026-124455?
How do I fix CVE-2026-124455?
No fix has been published for CVE-2026-124455 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-124455 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-124455 exists.
Sources
Also known as GHSA-hvp7-q2hp-6j6g, GHSA-wq2w-mvp4-xrqr.