OpenEMR: Missing authorization in portal onsite-document APIs (CVE-2026-124484)
OpenEMR versions prior to 8.4.0 contain a missing authorization flaw allowing authenticated users to access and modify cross-patient records by manipulating API parameters.
CVE search metadata
CVE search record: CVE-2026-124484. Severity: high. CVSS: 8.8. KEV: no. Product: OpenEMR (< 8.4.0). Brief: OpenEMR: Missing authorization in portal onsite-document APIs (CVE-2026-124484). Brief link: https://feed.craftedsignal.io/briefs/2026-11-openemr-auth-bypass-26f41790/
Triage facts
Revision 1- Applicability
- OpenEMR (< 8.4.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 8, 15:36 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
OpenEMR versions before 8.4.0 contain an authorization vulnerability in the portal onsite-document API endpoints. The vulnerability allows an authenticated core user to access, list, read, or overwrite cross-patient documents, signatures, and template data. This is achieved by omitting the 'patientId' parameter from API requests and providing arbitrary record IDs.
Impact
Successful exploitation results in unauthorized access to sensitive medical records and the ability to modify or overwrite patient document data and signatures, potentially leading to unauthorized data exposure and integrity loss.
Recommendation
- Patch OpenEMR to version 8.4.0 or later immediately to remediate the authorization check flaw.
- Audit web server logs for requests to portal onsite-document API endpoints that lack a 'patientId' parameter.
Immediate actions
Upgrade OpenEMR to version 8.4.0 or later
Threat Hunt
Identify API requests to portal onsite-document endpoints missing the patientId parameter
Data: Web server access logs
Mitigations
Upgrade OpenEMR to version 8.4.0 or later
CVE-2026-124484