OpenEMR: Missing authorization and IDOR in oe-module-prior-authorizations (CVE-2026-124456)

OpenEMR versions prior to 8.3.0 contain missing authorization and insecure direct object reference (IDOR) vulnerabilities within the oe-module-prior-authorizations module. These flaws allow an authenticated low-privilege user to access and manipulate sensitive patient data, including patient names, medical record numbers (MRNs), insurance details, and prior-authorization records.

Impact

Successful exploitation allows for unauthorized disclosure of Protected Health Information (PHI) and unauthorized modification of patient prior-authorization records.

Recommendation

• Upgrade OpenEMR to version 8.3.0 or later to apply the security fixes.
• Restrict user access to the oe-module-prior-authorizations module if immediate patching is not feasible.
• Monitor access logs for requests to public/reports/list_report.php and public/index.php that deviate from expected behavioral patterns for low-privilege user accounts.