OpenEMR: Broken object-level authorization in SOAP note API (CVE-2026-124473)
OpenEMR versions prior to 8.3.0 contain a broken object-level authorization vulnerability that allows authenticated users to overwrite clinical notes belonging to other patients by manipulating the SOAP note ID in API requests.
CVE search metadata
CVE search record: CVE-2026-124473. Severity: high. CVSS: 7.1. KEV: no. Product: OpenEMR (< 8.3.0). Brief: OpenEMR: Broken object-level authorization in SOAP note API (CVE-2026-124473). Brief link: https://feed.craftedsignal.io/briefs/2026-11-openemr-bola/
Triage facts
Revision 1- Applicability
- OpenEMR (< 8.3.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 8, 15:35 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
OpenEMR versions prior to 8.3.0 contain a broken object-level authorization (BOLA) vulnerability in the SOAP note update API. The application fails to verify that the provided SOAP note ID (sid) is associated with the patient and encounter specified in the request URI. An authenticated user with existing "encounters/notes" permissions can perform a PUT request to the API, allowing them to overwrite existing clinical notes and reassign the records to a different patient ID.
Impact
Successful exploitation results in unauthorized modification of clinical records and data integrity compromise within the electronic medical record system.
Recommendation
- Upgrade OpenEMR to version 8.3.0 or later to resolve the underlying authorization logic flaw.
- Audit web server logs for PUT requests to the SOAP note API where the requested Patient ID (pid) or Encounter ID (eid) may be inconsistent with access patterns or user-specific permissions.
- Review access control logs for users with "encounters/notes" permissions to identify anomalous update activity.
Immediate actions
Patch OpenEMR to version 8.3.0 or later
Threat Hunt
Identify PUT requests to /api/patient/*/encounter/*/soap_note/* where the authenticated user context does not match typical access scope for the targeted patient/encounter IDs.
Data: Web server access logs (method, URI, user_id, status_code)
Mitigations
Upgrade OpenEMR to 8.3.0
CVE-2026-124473