OpenEMR: Broken access control in portal_payment.php (CVE-2026-124489)
OpenEMR versions prior to 8.3.0 are vulnerable to broken access control, allowing authenticated, low-privileged users to modify patient identifiers to bypass billing restrictions and record fraudulent payments.
CVE search metadata
CVE search record: CVE-2026-124489. Severity: high. CVSS: 7.1. KEV: no. Product: OpenEMR (< 8.3.0). Brief: OpenEMR: Broken access control in portal_payment.php (CVE-2026-124489). Brief link: https://feed.craftedsignal.io/briefs/2026-11-openemr-broken-access-control/
Triage facts
Revision 1- Applicability
- OpenEMR (< 8.3.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 8, 15:36 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
OpenEMR versions before 8.3.0 contain a broken access control vulnerability in the portal/portal_payment.php script. An authenticated attacker with low privileges can bypass billing access control list (ACL) checks by manipulating the pid and form_pid parameters in requests. This allows unauthorized access to patient payment pages and the submission of fraudulent payment receipts, resulting in billing data corruption.
Impact
Successful exploitation allows unauthorized users to view sensitive payment data of arbitrary patients and inject fraudulent payment records into the system, compromising the integrity of financial billing records.
Recommendation
- Upgrade OpenEMR to version 8.3.0 or later immediately to patch the access control vulnerability in
portal_payment.php. - Audit billing records for entries created by low-privilege accounts, specifically looking for irregularities in
pidandform_pidparameter associations.
Immediate actions
Upgrade OpenEMR to version 8.3.0 or later
Threat Hunt
Identify unauthorized access to portal_payment.php by low-privileged accounts
Data: Web server access logs containing request parameters for portal/portal_payment.php
Mitigations
Upgrade to 8.3.0
CVE-2026-124489