Skip to content
Threat Feed
Subscribe
high advisory

OpenEMR: Missing authorization in document upload (CVE-2026-124461)

OpenEMR versions prior to 8.3.0 are susceptible to an authorization bypass vulnerability allowing authenticated users to read and overwrite arbitrary document data via the library/ajax/upload.php script.

CVE search metadata

CVE search record: CVE-2026-124461. Severity: high. CVSS: 8.1. KEV: no. Product: OpenEMR (< 8.3.0). Brief: OpenEMR: Missing authorization in document upload (CVE-2026-124461). Brief link: https://feed.craftedsignal.io/briefs/2026-11-openemr-auth-bypass-a575c508/

Triage facts

Revision 1
Applicability
OpenEMR (< 8.3.0)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Nov 8, 15:34 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A2Roughly even chance

OpenEMR versions prior to 8.3.0 contain a missing authorization vulnerability in 'library/ajax/upload.php'. This flaw permits an authenticated user to perform unauthorized read and write operations on document data by manipulating the 'doc_id' parameter.

Impact

Successful exploitation allows low-privileged users to enumerate document IDs, leading to the unauthorized disclosure of patient health information (PHI) and the potential tampering of medical records across the entire installation.

Recommendation

  • Upgrade OpenEMR to version 8.3.0 or later to remediate the authorization logic flaw.
  • Implement strict access control monitoring for requests directed to 'library/ajax/upload.php'.
  • Review application access logs for abnormal volumes of requests to the document upload endpoint, specifically those targeting sequential or unusual 'doc_id' values.

Immediate actions

Upgrade OpenEMR to version 8.3.0 or later

IT Operations 48h

Threat Hunt

Identify authenticated users making high-frequency POST requests to library/ajax/upload.php

high medium confidence hunt now

Data: webserver logs containing UserID and request volume per minute

Mitigations

Apply security patch by upgrading to OpenEMR 8.3.0

immediate IT Operations

CVE-2026-124461

Detection coverage 1

Detect CVE-2026-124461 Exploitation - Authorization Bypass in library/ajax/upload.php

high

Detects potential exploitation of CVE-2026-124461 by monitoring for unauthorized document access patterns via the library/ajax/upload.php endpoint

sigma tactics: exfiltration techniques: T1020 sources: webserver

Detection queries are available on the platform. Get full rules →