CVE-2026-124472 OpenEMR before 8.3.0 Missing Authorization via sl_eob_patient_note.php

High 8.6 Published 8 Nov 2026 Updated 12 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-124472?

CVE-2026-124472 is a high-severity vulnerability in openemr, published on 8 Nov 2026.

Official description

OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_patient_note.php that allows any authenticated user to read and modify patient billing notes. Attackers with low-privilege accounts can enumerate the patient_id parameter and submit POST requests using the embedded CSRF token to view or tamper with confidential billing data.

Weakness: CWE-862

Which versions are affected by CVE-2026-124472?

How do I fix CVE-2026-124472?

No fix has been published for CVE-2026-124472 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-124472 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-124472 exists.

Sources

Also known as GHSA-74j7-7q95-rvxg, GHSA-hmxh-v4q7-5wcq.