Skip to content
Threat Feed
Subscribe
high advisory

OpenEMR: Missing authorization in patient recall records (CVE-2026-124477)

OpenEMR versions prior to 8.3.0 are vulnerable to an authorization bypass allowing authenticated, low-privileged users to delete arbitrary patient recall records via the delete_Recall action.

CVE search metadata

CVE search record: CVE-2026-124477. Severity: high. CVSS: 8.8. KEV: no. Product: OpenEMR (< 8.3.0). Brief: OpenEMR: Missing authorization in patient recall records (CVE-2026-124477). Brief link: https://feed.craftedsignal.io/briefs/2026-11-openemr-auth-bypass-c78c243c/

Triage facts

Revision 1
Applicability
OpenEMR (< 8.3.0)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Nov 8, 15:36 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A1Likely

OpenEMR versions before 8.3.0 contain a missing authorization vulnerability (CVE-2026-124477) that allows low-privileged authenticated users to delete arbitrary patient recall records. The vulnerability is triggered by sending a POST request to /interface/main/messages/save.php with the delete_Recall action, targeting a specific patient ID (pid) and record ID (r_ID). The application fails to perform necessary Access Control List (ACL) or ownership checks before processing the deletion, leading to unauthorized data loss.

Impact

Successful exploitation allows an authenticated attacker to delete patient recall data, potentially causing medical records disruption or data loss.

Recommendation

  • Upgrade OpenEMR to version 8.3.0 or later immediately to resolve the missing authorization check.
  • Audit access logs for unauthorized access or execution of the delete_Recall action by low-privileged user accounts.

Immediate actions

Patch OpenEMR to 8.3.0 or later

IT Operations 48h

Hunt for historical exploitation of the delete_Recall action

SOC 24h

Mitigations

Upgrade to OpenEMR 8.3.0

immediate IT Operations

CVE-2026-124477

Detection coverage 1

Detect CVE-2026-124477 Exploitation - Unauthorized Patient Recall Deletion

high

Detects exploitation of CVE-2026-124477 by monitoring POST requests to the message save endpoint that invoke the delete_Recall action

sigma tactics: privilege-escalation techniques: T1068 sources: webserver

Detection queries are available on the platform. Get full rules →