CVE-2026-124456 OpenEMR before 8.3.0 Missing Authorization and IDOR in Prior-Authorizations Module
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-124456?
CVE-2026-124456 is a high-severity vulnerability in openemr, published on 8 Nov 2026.
Official description
OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the oe-module-prior-authorizations module that allow authenticated low-privilege users to access and modify other patients' records. Attackers can request public/reports/list_report.php to view all patients' names, MRNs, insurance and prior-auth data, or submit arbitrary id values to public/index.php to overwrite other patients' prior-authorization records.
Weakness: CWE-862
Which versions are affected by CVE-2026-124456?
How do I fix CVE-2026-124456?
No fix has been published for CVE-2026-124456 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-124456 being exploited?
There is no known exploitation of CVE-2026-124456 in the wild and no public exploit code.
Sources
Also known as GHSA-9cgf-m88m-9cvx, GHSA-m7wh-83wm-x2gq.