CVE-2026-124462 OpenEMR before 8.3.0 Patient Portal IDOR via Case-Sensitive Pid Parameter

High 7.1 Published 8 Nov 2026 Updated 8 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-124462?

CVE-2026-124462 is a high-severity vulnerability in openemr, published on 8 Nov 2026.

Official description

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query() that allows authenticated portal patients to bypass the lowercase pid authorization guard by supplying a capitalised Pid parameter. Attackers can request the api/onsitedocuments endpoint with Pid set to another patient's id to overwrite the session-pinned criteria and read other patients' onsite documents containing PHI.

Weakness: CWE-639

Which versions are affected by CVE-2026-124462?

How do I fix CVE-2026-124462?

No fix has been published for CVE-2026-124462 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-124462 being exploited?

There is no known exploitation of CVE-2026-124462 in the wild and no public exploit code.

Sources

Also known as GHSA-39jh-r9hg-rwg7, GHSA-mhv5-qf28-cmp6.