CVE-2026-124481 OpenEMR before 8.4.0 Cross-Patient Payment Tampering via Rainforest Portal Payments
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-124481?
CVE-2026-124481 is a high-severity vulnerability in openemr, published on 8 Nov 2026.
Official description
OpenEMR before 8.4.0 contains an improper authorization vulnerability in Rainforest patient portal payments that trusts browser-supplied patientId, encounter, and amount values instead of deriving them from the portal session. Authenticated portal patients can tamper with JSON sent to portal_payment.rainforest.php so the payin.authorized webhook writes forged ar_activity credits to other patients' encounters exceeding the amount actually paid.
Weakness: CWE-639
Which versions are affected by CVE-2026-124481?
How do I fix CVE-2026-124481?
No fix has been published for CVE-2026-124481 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-124481 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-124481 exists.
Sources
Also known as GHSA-525m-fch5-vqqm, GHSA-r67g-7xmv-5q36.