OpenEMR: SQL injection via mass assignment in patient portal (CVE-2026-124444)
OpenEMR versions before 8.4.0 contain a mass assignment vulnerability in the patient portal OnsiteDocument query API that facilitates SQL injection.
CVE search metadata
CVE search record: CVE-2026-124444. Severity: high. CVSS: 7.1. KEV: no. Product: OpenEMR (< 8.4.0). Brief: OpenEMR: SQL injection via mass assignment in patient portal (CVE-2026-124444). Brief link: https://feed.craftedsignal.io/briefs/2026-11-openemr-sql-injection/
Triage facts
Revision 1- Applicability
- OpenEMR (< 8.4.0)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 8, 15:31 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
OpenEMR before 8.4.0 contains a mass assignment vulnerability in the patient portal OnsiteDocument query API. The flaw allows request parameters to set bitwise criteria filters that are placed unquoted into the SQL WHERE clause. Authenticated patient portal users can exploit this to perform SQL injection and read any database table, including other patients' records and staff password hashes.