{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/openemr--8.3.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-124469"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenEMR (\u003c 8.3.0)"],"_cs_severities":["critical"],"_cs_tags":["web-application","sql-injection","health-sector"],"_cs_type":"advisory","_cs_vendors":["OpenEMR"],"content_html":"\u003cp\u003eOpenEMR versions before 8.3.0 contain an SQL injection vulnerability in the \u003ccode\u003eDrugSalesService::sellDrug\u003c/code\u003e method. The vulnerability arises from improper sanitization of the \u003ccode\u003eprod[N][warehouse]\u003c/code\u003e POST field before it is used in an \u003ccode\u003eORDER BY\u003c/code\u003e clause. An authenticated attacker with low privileges can leverage this flaw to perform time-based blind SQL injection attacks to exfiltrate sensitive data, such as patient records and bcrypt hashes of user credentials.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated attackers to perform unauthorized data extraction, leading to the compromise of patient PII and user authentication data (bcrypt hashes).\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to OpenEMR version 8.3.0 or later to address the vulnerability.\u003c/li\u003e\n\u003cli\u003eAudit access logs for abnormal POST request patterns to the \u003ccode\u003eDrugSalesService\u003c/code\u003e or Fee Sheet-related endpoints containing SQL injection syntax, particularly within the \u003ccode\u003eprod[N][warehouse]\u003c/code\u003e parameter.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T21:26:25Z","date_published":"2026-11-08T21:26:25Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openemr-sqli/","summary":"OpenEMR versions prior to 8.3.0 are susceptible to time-based blind SQL injection in the Fee Sheet component, allowing low-privileged authenticated users to exfiltrate patient data and user hashes.","title":"OpenEMR: SQL injection in Fee Sheet drug-inventory lookup (CVE-2026-124469)","url":"https://feed.craftedsignal.io/briefs/2026-11-openemr-sqli/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-124453"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenEMR (\u003c 8.3.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eOpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php. Authenticated portal patients can modify the setting_patient parameter in a JSON POST request to another patient's PID, allowing them to alter that patient's portal settings, such as the portal theme.\u003c/p\u003e\n","date_modified":"2026-11-08T19:33:41Z","date_published":"2026-11-08T19:33:41Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openemr-idor-4ecb7d2c/","summary":"OpenEMR versions before 8.3.0 contain an insecure direct object reference vulnerability in portal/lib/persist.php that allows authenticated portal patients to write settings for other patients.","title":"OpenEMR: Insecure direct object reference in portal/lib/persist.php (CVE-2026-124453)","url":"https://feed.craftedsignal.io/briefs/2026-11-openemr-idor-4ecb7d2c/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-124471"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenEMR (\u003c 8.3.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["OpenEMR"],"content_html":"\u003cp\u003eOpenEMR versions prior to 8.3.0 are vulnerable to a missing authorization flaw in 'interface/billing/sl_eob_invoice.php'. The vulnerability allows an authenticated user to perform unauthorized operations by manipulating the 'id' parameter in HTTP requests. Impacted operations include reading patient names and billing notes, posting payments, applying adjustments, and deleting billing entries for any encounter regardless of the user's assigned permissions.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized data disclosure (PII/PHI) and modification of financial and clinical billing records across all patient encounters.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenEMR to version 8.3.0 or later to remediate CVE-2026-124471.\u003c/li\u003e\n\u003cli\u003eAudit access logs for the 'interface/billing/sl_eob_invoice.php' endpoint to identify patterns of excessive or abnormal requests to the 'id' parameter by non-billing personnel.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T17:30:44Z","date_published":"2026-11-08T17:30:44Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openemr-auth-bypass-dbd20544/","summary":"OpenEMR versions prior to 8.3.0 contain an authorization bypass in the sl_eob_invoice.php script that allows authenticated users to read and modify arbitrary billing records via parameter manipulation.","title":"OpenEMR: Missing authorization in billing module (CVE-2026-124471)","url":"https://feed.craftedsignal.io/briefs/2026-11-openemr-auth-bypass-dbd20544/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.7,"id":"CVE-2026-124463"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenEMR (\u003c 8.3.0)"],"_cs_severities":["high"],"_cs_tags":["xss","web-application","medical-software"],"_cs_type":"advisory","_cs_vendors":["OpenEMR"],"content_html":"\u003cp\u003eOpenEMR versions before 8.3.0 contain a stored cross-site scripting (XSS) vulnerability. Authenticated users with CAMOS (Computerized Assisted Medical Office Suite) access can inject malicious HTML or scripts by saving content through the \u003ccode\u003eajax_save.php\u003c/code\u003e endpoint. The payload is subsequently executed when a victim accesses the entry via the \u003ccode\u003erx_print.php\u003c/code\u003e script (specifically the non-print_html branch), allowing the attacker to perform actions or read data as the authenticated user.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated attackers to perform unauthorized actions or exfiltrate sensitive data by executing scripts within the browser session of a victim user who views the malicious content.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenEMR to version 8.3.0 or later to remediate the vulnerability.\u003c/li\u003e\n\u003cli\u003eAudit access controls for the CAMOS module to ensure only trusted users have the ability to save content.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for suspicious POST requests to \u003ccode\u003eajax_save.php\u003c/code\u003e containing script-related characters.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T17:30:33Z","date_published":"2026-11-08T17:30:33Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openemr-xss-0acba206/","summary":"OpenEMR versions prior to 8.3.0 contain a stored cross-site scripting vulnerability allowing authenticated users with CAMOS access to execute arbitrary scripts in a victim context.","title":"OpenEMR: Stored Cross-Site Scripting (CVE-2026-124463)","url":"https://feed.craftedsignal.io/briefs/2026-11-openemr-xss-0acba206/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:openemr:openemr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-124450"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenEMR (\u003c 8.3.0)"],"_cs_severities":["critical"],"_cs_tags":["cve-2026-124450","path-traversal","rce","webserver"],"_cs_type":"advisory","_cs_vendors":["OpenEMR"],"content_html":"\u003cp\u003eOpenEMR versions prior to 8.3.0 contain a broken access control and path traversal vulnerability in the fax/sms module's 'disposeDocument' action. The vulnerability stems from an unvalidated 'file_path' parameter, which allows authenticated, low-privileged users to perform arbitrary file reads (including the retrieval of database credentials from 'sqlconf.php') and arbitrary file writes as the web service user, ultimately leading to remote code execution.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAuthenticated low-privilege users can recover database credentials, modify application configuration, or achieve remote code execution on the underlying server as the web service user.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch OpenEMR to version 8.3.0 or later immediately to resolve the vulnerability.\u003c/li\u003e\n\u003cli\u003eAudit access logs for authentication-related activity followed by suspicious requests to the 'fax/sms' module.\u003c/li\u003e\n\u003cli\u003eMonitor for unauthorized file modification in the OpenEMR web directory.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T16:50:56Z","date_published":"2026-11-08T16:50:56Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openemr-path-traversal-803ffbda/","summary":"OpenEMR versions prior to 8.3.0 are vulnerable to path traversal in the fax/sms module, allowing authenticated attackers to read sensitive files and execute arbitrary code via file write.","title":"OpenEMR: Arbitrary file read and write vulnerability (CVE-2026-124450)","url":"https://feed.craftedsignal.io/briefs/2026-11-openemr-path-traversal-803ffbda/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-124489"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenEMR (\u003c 8.3.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["OpenEMR"],"content_html":"\u003cp\u003eOpenEMR versions before 8.3.0 contain a broken access control vulnerability in the \u003ccode\u003eportal/portal_payment.php\u003c/code\u003e script. An authenticated attacker with low privileges can bypass billing access control list (ACL) checks by manipulating the \u003ccode\u003epid\u003c/code\u003e and \u003ccode\u003eform_pid\u003c/code\u003e parameters in requests. This allows unauthorized access to patient payment pages and the submission of fraudulent payment receipts, resulting in billing data corruption.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthorized users to view sensitive payment data of arbitrary patients and inject fraudulent payment records into the system, compromising the integrity of financial billing records.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenEMR to version 8.3.0 or later immediately to patch the access control vulnerability in \u003ccode\u003eportal_payment.php\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAudit billing records for entries created by low-privilege accounts, specifically looking for irregularities in \u003ccode\u003epid\u003c/code\u003e and \u003ccode\u003eform_pid\u003c/code\u003e parameter associations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T15:36:54Z","date_published":"2026-11-08T15:36:54Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openemr-broken-access-control/","summary":"OpenEMR versions prior to 8.3.0 are vulnerable to broken access control, allowing authenticated, low-privileged users to modify patient identifiers to bypass billing restrictions and record fraudulent payments.","title":"OpenEMR: Broken access control in portal_payment.php (CVE-2026-124489)","url":"https://feed.craftedsignal.io/briefs/2026-11-openemr-broken-access-control/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-124477"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenEMR (\u003c 8.3.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["OpenEMR"],"content_html":"\u003cp\u003eOpenEMR versions before 8.3.0 contain a missing authorization vulnerability (CVE-2026-124477) that allows low-privileged authenticated users to delete arbitrary patient recall records. The vulnerability is triggered by sending a POST request to \u003ccode\u003e/interface/main/messages/save.php\u003c/code\u003e with the \u003ccode\u003edelete_Recall\u003c/code\u003e action, targeting a specific patient ID (pid) and record ID (r_ID). The application fails to perform necessary Access Control List (ACL) or ownership checks before processing the deletion, leading to unauthorized data loss.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated attacker to delete patient recall data, potentially causing medical records disruption or data loss.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenEMR to version 8.3.0 or later immediately to resolve the missing authorization check.\u003c/li\u003e\n\u003cli\u003eAudit access logs for unauthorized access or execution of the \u003ccode\u003edelete_Recall\u003c/code\u003e action by low-privileged user accounts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T15:36:08Z","date_published":"2026-11-08T15:36:08Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openemr-auth-bypass-c78c243c/","summary":"OpenEMR versions prior to 8.3.0 are vulnerable to an authorization bypass allowing authenticated, low-privileged users to delete arbitrary patient recall records via the delete_Recall action.","title":"OpenEMR: Missing authorization in patient recall records (CVE-2026-124477)","url":"https://feed.craftedsignal.io/briefs/2026-11-openemr-auth-bypass-c78c243c/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-124473"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenEMR (\u003c 8.3.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["OpenEMR"],"content_html":"\u003cp\u003eOpenEMR versions prior to 8.3.0 contain a broken object-level authorization (BOLA) vulnerability in the SOAP note update API. The application fails to verify that the provided SOAP note ID (sid) is associated with the patient and encounter specified in the request URI. An authenticated user with existing \u0026quot;encounters/notes\u0026quot; permissions can perform a PUT request to the API, allowing them to overwrite existing clinical notes and reassign the records to a different patient ID.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in unauthorized modification of clinical records and data integrity compromise within the electronic medical record system.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenEMR to version 8.3.0 or later to resolve the underlying authorization logic flaw.\u003c/li\u003e\n\u003cli\u003eAudit web server logs for PUT requests to the SOAP note API where the requested Patient ID (pid) or Encounter ID (eid) may be inconsistent with access patterns or user-specific permissions.\u003c/li\u003e\n\u003cli\u003eReview access control logs for users with \u0026quot;encounters/notes\u0026quot; permissions to identify anomalous update activity.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T15:35:53Z","date_published":"2026-11-08T15:35:53Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openemr-bola/","summary":"OpenEMR versions prior to 8.3.0 contain a broken object-level authorization vulnerability that allows authenticated users to overwrite clinical notes belonging to other patients by manipulating the SOAP note ID in API requests.","title":"OpenEMR: Broken object-level authorization in SOAP note API (CVE-2026-124473)","url":"https://feed.craftedsignal.io/briefs/2026-11-openemr-bola/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-124472"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenEMR (\u003c 8.3.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["OpenEMR"],"content_html":"\u003cp\u003eOpenEMR versions before 8.3.0 contain a missing authorization vulnerability in the script 'interface/billing/sl_eob_patient_note.php'. This vulnerability enables an authenticated user to perform unauthorized read and modification operations on patient billing notes. By manipulating the 'patient_id' parameter in HTTP POST requests and reusing legitimate CSRF tokens, a low-privilege attacker can access confidential data belonging to other patients.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows unauthorized access to and tampering with patient billing records, which constitutes a significant compromise of protected health information (PHI) and data integrity within the OpenEMR instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenEMR to version 8.3.0 or later immediately to remediate the missing authorization check.\u003c/li\u003e\n\u003cli\u003eReview application access logs for anomalous POST request patterns directed at 'sl_eob_patient_note.php', specifically where the 'patient_id' parameter varies rapidly or is accessed by accounts that lack administrative or billing roles.\u003c/li\u003e\n\u003cli\u003eAudit user permissions and ensure that Principle of Least Privilege is applied to all clinical and billing staff accounts to limit the blast radius of compromised credentials.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T15:35:35Z","date_published":"2026-11-08T15:35:35Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openemr-auth-bypass-37ec9377/","summary":"OpenEMR versions prior to 8.3.0 are vulnerable to a missing authorization flaw allowing authenticated low-privileged users to read and modify sensitive patient billing notes via parameter manipulation.","title":"OpenEMR: Missing authorization in billing notes (CVE-2026-124472)","url":"https://feed.craftedsignal.io/briefs/2026-11-openemr-auth-bypass-37ec9377/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-124461"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenEMR (\u003c 8.3.0)"],"_cs_severities":["high"],"_cs_tags":["web-application-vulnerability","authorization-bypass","health-sector"],"_cs_type":"advisory","_cs_vendors":["OpenEMR"],"content_html":"\u003cp\u003eOpenEMR versions prior to 8.3.0 contain a missing authorization vulnerability in 'library/ajax/upload.php'. This flaw permits an authenticated user to perform unauthorized read and write operations on document data by manipulating the 'doc_id' parameter.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows low-privileged users to enumerate document IDs, leading to the unauthorized disclosure of patient health information (PHI) and the potential tampering of medical records across the entire installation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenEMR to version 8.3.0 or later to remediate the authorization logic flaw.\u003c/li\u003e\n\u003cli\u003eImplement strict access control monitoring for requests directed to 'library/ajax/upload.php'.\u003c/li\u003e\n\u003cli\u003eReview application access logs for abnormal volumes of requests to the document upload endpoint, specifically those targeting sequential or unusual 'doc_id' values.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T15:34:30Z","date_published":"2026-11-08T15:34:30Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openemr-auth-bypass-a575c508/","summary":"OpenEMR versions prior to 8.3.0 are susceptible to an authorization bypass vulnerability allowing authenticated users to read and overwrite arbitrary document data via the library/ajax/upload.php script.","title":"OpenEMR: Missing authorization in document upload (CVE-2026-124461)","url":"https://feed.craftedsignal.io/briefs/2026-11-openemr-auth-bypass-a575c508/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-124459"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenEMR (\u003c 8.3.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["OpenEMR"],"content_html":"\u003cp\u003eOpenEMR versions before 8.3.0 contain an insecure direct object reference (IDOR) vulnerability in multiple encounter-form view and save endpoints. These endpoints fail to perform patient or encounter ownership validation checks. An authenticated clinical user can leverage this by incrementing sequential form ID values within HTTP requests to view or overwrite clinical data belonging to other patients.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated attacker to read sensitive clinical records and modify or overwrite medical data belonging to other patients, leading to potential data corruption and unauthorized information disclosure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenEMR to version 8.3.0 or later immediately to patch the missing ownership checks.\u003c/li\u003e\n\u003cli\u003eRestrict access to clinical form endpoints for non-clinical user roles if the update cannot be applied immediately.\u003c/li\u003e\n\u003cli\u003eImplement granular auditing of access to encounter-form endpoints to identify anomalous enumeration patterns.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T15:32:29Z","date_published":"2026-11-08T15:32:29Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openemr-idor-db815b70/","summary":"OpenEMR versions prior to 8.3.0 are susceptible to an Insecure Direct Object Reference (IDOR) vulnerability that allows authenticated users to access and modify clinical records belonging to other patients by enumerating form IDs.","title":"OpenEMR: Insecure Direct Object Reference in encounter-form endpoints (CVE-2026-124459)","url":"https://feed.craftedsignal.io/briefs/2026-11-openemr-idor-db815b70/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-124456"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenEMR (\u003c 8.3.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["OpenEMR"],"content_html":"\u003cp\u003eOpenEMR versions prior to 8.3.0 contain missing authorization and insecure direct object reference (IDOR) vulnerabilities within the \u003ccode\u003eoe-module-prior-authorizations\u003c/code\u003e module. These flaws allow an authenticated low-privilege user to access and manipulate sensitive patient data, including patient names, medical record numbers (MRNs), insurance details, and prior-authorization records.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized disclosure of Protected Health Information (PHI) and unauthorized modification of patient prior-authorization records.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenEMR to version 8.3.0 or later to apply the security fixes.\u003c/li\u003e\n\u003cli\u003eRestrict user access to the \u003ccode\u003eoe-module-prior-authorizations\u003c/code\u003e module if immediate patching is not feasible.\u003c/li\u003e\n\u003cli\u003eMonitor access logs for requests to \u003ccode\u003epublic/reports/list_report.php\u003c/code\u003e and \u003ccode\u003epublic/index.php\u003c/code\u003e that deviate from expected behavioral patterns for low-privilege user accounts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T15:32:12Z","date_published":"2026-11-08T15:32:12Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openemr-idor-f0a19413/","summary":"OpenEMR versions before 8.3.0 contain IDOR and authorization flaws in the oe-module-prior-authorizations module that allow authenticated users to access and modify patient records.","title":"OpenEMR: Missing authorization and IDOR in oe-module-prior-authorizations (CVE-2026-124456)","url":"https://feed.craftedsignal.io/briefs/2026-11-openemr-idor-f0a19413/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.6,"id":"CVE-2026-124448"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenEMR (\u003c 8.3.0)"],"_cs_severities":["high"],"_cs_tags":["xss","web-application-vulnerability","health-sector"],"_cs_type":"advisory","_cs_vendors":["OpenEMR"],"content_html":"\u003cp\u003eOpenEMR versions prior to 8.3.0 contain stored cross-site scripting (XSS) vulnerabilities within the CCDA/CCD preview stylesheets. Specifically, the cda.xsl and ccd.xsl files fail to properly sanitize input, allowing event-handler attributes such as onmouseover, onclick, and onfocus to be injected into previewed HTML. An authenticated attacker can upload a crafted CCDA/CCD document containing these malicious handlers to execute unauthorized JavaScript in the context of a clinician's session.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated attackers to execute arbitrary JavaScript within a clinician's session, potentially leading to unauthorized data access, session hijacking, or other actions performed with the clinician's privileges within the OpenEMR application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenEMR to version 8.3.0 or later to apply the fix for CVE-2026-124448.\u003c/li\u003e\n\u003cli\u003eImplement Content Security Policy (CSP) headers that restrict inline script execution to reduce the impact of XSS vulnerabilities.\u003c/li\u003e\n\u003cli\u003eAudit access logs for user accounts uploading CCDA/CCD documents to identify potential abuse of the file upload functionality.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T15:31:55Z","date_published":"2026-11-08T15:31:55Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openemr-xss/","summary":"OpenEMR versions before 8.3.0 are vulnerable to stored cross-site scripting via maliciously crafted CCDA/CCD document attachments that execute scripts in a clinician's session upon preview.","title":"OpenEMR: Stored cross-site scripting in CCDA/CCD preview (CVE-2026-124448)","url":"https://feed.craftedsignal.io/briefs/2026-11-openemr-xss/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-124447"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenEMR (\u003c 8.3.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["OpenEMR"],"content_html":"\u003cp\u003eOpenEMR versions before 8.3.0 are susceptible to an Insecure Direct Object Reference (IDOR) vulnerability located in the \u003ccode\u003eOnsitePortalActivityController::Update()\u003c/code\u003e function. The application fails to validate whether the authenticated patient ID matches the record owner ID. An attacker with a valid patient portal account can manipulate PUT requests to the \u003ccode\u003eonsiteportalactivity\u003c/code\u003e API by specifying arbitrary activity IDs alongside their own patient ID. This leads to the unauthorized disclosure of \u003ccode\u003etableArgs\u003c/code\u003e and \u003ccode\u003echecksum\u003c/code\u003e data, as well as the ability to overwrite activity narratives and status, effectively allowing the attacker to assume ownership of another patient's medical activity records.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthorized disclosure of sensitive medical activity data, modification of existing record narratives and status fields, and account-level record takeover within the OpenEMR patient portal.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenEMR to version 8.3.0 or later to include the fix for CVE-2026-124447.\u003c/li\u003e\n\u003cli\u003eAudit web server logs for suspicious PUT requests to the \u003ccode\u003eonsiteportalactivity\u003c/code\u003e API endpoint, specifically monitoring for instances where the authenticated user ID is linked to record IDs that do not belong to that session context.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T15:31:47Z","date_published":"2026-11-08T15:31:47Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openemr-idor/","summary":"OpenEMR versions prior to 8.3.0 contain an Insecure Direct Object Reference vulnerability in the OnsitePortalActivityController::Update() function that allows authenticated portal patients to access, modify, and assume ownership of records belonging to other patients.","title":"OpenEMR: Insecure direct object reference in OnsitePortalActivityController (CVE-2026-124447)","url":"https://feed.craftedsignal.io/briefs/2026-11-openemr-idor/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-124490"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenEMR (\u003c 8.3.0)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["OpenEMR"],"content_html":"\u003cp\u003eOpenEMR versions before 8.3.0 contain a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument() method of the oe-module-faxsms component. An authenticated attacker can exploit the file_path parameter to read sensitive files, such as configuration files containing credentials or source code. Furthermore, an attacker can use the action=setup parameter with base64-encoded content to write web-executable files, leading to remote code execution.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows authenticated attackers to perform unauthorized file system reads and writes, resulting in potential exposure of sensitive data (credentials/source code) and full system compromise via remote code execution.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenEMR to version 8.3.0 or later immediately to resolve the vulnerable disposeDocument() method.\u003c/li\u003e\n\u003cli\u003eAudit web server access logs for requests directed at the oe-module-faxsms component containing path traversal patterns (e.g., ../, ..).\u003c/li\u003e\n\u003cli\u003eReview user access privileges for the OpenEMR instance to limit exposure to authenticated session exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T15:29:19Z","date_published":"2026-11-08T15:29:19Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openemr-path-traversal/","summary":"OpenEMR versions prior to 8.3.0 are vulnerable to path traversal within the RingCentral RCFaxClient disposeDocument() method, enabling authenticated attackers to read arbitrary files or achieve remote code execution via file writes.","title":"OpenEMR: Path traversal in RingCentral RCFaxClient (CVE-2026-124490)","url":"https://feed.craftedsignal.io/briefs/2026-11-openemr-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - OpenEMR (\u003c 8.3.0)","version":"https://jsonfeed.org/version/1.1"}