OpenEMR: Insecure direct object reference in OnsitePortalActivityController (CVE-2026-124447)

OpenEMR versions before 8.3.0 are susceptible to an Insecure Direct Object Reference (IDOR) vulnerability located in the OnsitePortalActivityController::Update() function. The application fails to validate whether the authenticated patient ID matches the record owner ID. An attacker with a valid patient portal account can manipulate PUT requests to the onsiteportalactivity API by specifying arbitrary activity IDs alongside their own patient ID. This leads to the unauthorized disclosure of tableArgs and checksum data, as well as the ability to overwrite activity narratives and status, effectively allowing the attacker to assume ownership of another patient's medical activity records.

Impact

Successful exploitation allows unauthorized disclosure of sensitive medical activity data, modification of existing record narratives and status fields, and account-level record takeover within the OpenEMR patient portal.

Recommendation

• Upgrade OpenEMR to version 8.3.0 or later to include the fix for CVE-2026-124447.
• Audit web server logs for suspicious PUT requests to the onsiteportalactivity API endpoint, specifically monitoring for instances where the authenticated user ID is linked to record IDs that do not belong to that session context.