OpenEMR: Missing authorization in billing notes (CVE-2026-124472)

OpenEMR versions before 8.3.0 contain a missing authorization vulnerability in the script 'interface/billing/sl_eob_patient_note.php'. This vulnerability enables an authenticated user to perform unauthorized read and modification operations on patient billing notes. By manipulating the 'patient_id' parameter in HTTP POST requests and reusing legitimate CSRF tokens, a low-privilege attacker can access confidential data belonging to other patients.

Impact

The vulnerability allows unauthorized access to and tampering with patient billing records, which constitutes a significant compromise of protected health information (PHI) and data integrity within the OpenEMR instance.

Recommendation

• Upgrade OpenEMR to version 8.3.0 or later immediately to remediate the missing authorization check.
• Review application access logs for anomalous POST request patterns directed at 'sl_eob_patient_note.php', specifically where the 'patient_id' parameter varies rapidly or is accessed by accounts that lack administrative or billing roles.
• Audit user permissions and ensure that Principle of Least Privilege is applied to all clinical and billing staff accounts to limit the blast radius of compromised credentials.