OpenEMR: Insecure Direct Object Reference in encounter-form endpoints (CVE-2026-124459)

OpenEMR versions before 8.3.0 contain an insecure direct object reference (IDOR) vulnerability in multiple encounter-form view and save endpoints. These endpoints fail to perform patient or encounter ownership validation checks. An authenticated clinical user can leverage this by incrementing sequential form ID values within HTTP requests to view or overwrite clinical data belonging to other patients.

Impact

Successful exploitation allows an authenticated attacker to read sensitive clinical records and modify or overwrite medical data belonging to other patients, leading to potential data corruption and unauthorized information disclosure.

Recommendation

• Upgrade OpenEMR to version 8.3.0 or later immediately to patch the missing ownership checks.
• Restrict access to clinical form endpoints for non-clinical user roles if the update cannot be applied immediately.
• Implement granular auditing of access to encounter-form endpoints to identify anomalous enumeration patterns.