CVE-2026-124461 OpenEMR before 8.3.0 IDOR via DICOM library/ajax/upload.php Endpoint
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-124461?
CVE-2026-124461 is a high-severity vulnerability in openemr, published on 8 Nov 2026.
Official description
OpenEMR before 8.3.0 contains a missing authorization vulnerability in library/ajax/upload.php that allows any authenticated user to read and overwrite document data by supplying an arbitrary doc_id. Low-privilege users can enumerate doc_id values with the fetch and save actions to disclose patient health information and tamper with medical records across all patients.
Weakness: CWE-862
Which versions are affected by CVE-2026-124461?
How do I fix CVE-2026-124461?
No fix has been published for CVE-2026-124461 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-124461 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-124461 exists.
Sources
Also known as GHSA-7h7v-29jv-527v, GHSA-x7rh-2f5c-xx9f.