OpenEMR: Missing authorization in billing module (CVE-2026-124471)
OpenEMR versions prior to 8.3.0 contain an authorization bypass in the sl_eob_invoice.php script that allows authenticated users to read and modify arbitrary billing records via parameter manipulation.
CVE search metadata
CVE search record: CVE-2026-124471. Severity: high. CVSS: 8.1. KEV: no. Product: OpenEMR (< 8.3.0). Brief: OpenEMR: Missing authorization in billing module (CVE-2026-124471). Brief link: https://feed.craftedsignal.io/briefs/2026-11-openemr-auth-bypass-dbd20544/
Triage facts
Revision 1- Applicability
- OpenEMR (< 8.3.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 8, 17:30 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
OpenEMR versions prior to 8.3.0 are vulnerable to a missing authorization flaw in 'interface/billing/sl_eob_invoice.php'. The vulnerability allows an authenticated user to perform unauthorized operations by manipulating the 'id' parameter in HTTP requests. Impacted operations include reading patient names and billing notes, posting payments, applying adjustments, and deleting billing entries for any encounter regardless of the user's assigned permissions.
Impact
Successful exploitation allows for unauthorized data disclosure (PII/PHI) and modification of financial and clinical billing records across all patient encounters.
Recommendation
- Upgrade OpenEMR to version 8.3.0 or later to remediate CVE-2026-124471.
- Audit access logs for the 'interface/billing/sl_eob_invoice.php' endpoint to identify patterns of excessive or abnormal requests to the 'id' parameter by non-billing personnel.
Immediate actions
Patch OpenEMR to version 8.3.0 or later.
Threat Hunt
Identify abnormal request volume or parameter enumeration to sl_eob_invoice.php.
Data: Web server access logs (cs-uri-stem, cs-uri-query, cs-username)
Mitigations
Restrict network access to the OpenEMR billing interface to authorized subnets.
CVE-2026-124471