OpenEMR (< 8.3.0) - CraftedSignal Threat Feed

OpenEMR: SQL injection in Fee Sheet drug-inventory lookup (CVE-2026-124469)

hello@craftedsignal.io — Sun, 08 Nov 2026 21:26:25 +0000

OpenEMR versions before 8.3.0 contain an SQL injection vulnerability in the DrugSalesService::sellDrug method. The vulnerability arises from improper sanitization of the prod[N][warehouse] POST field before it is used in an ORDER BY clause. An authenticated attacker with low privileges can leverage this flaw to perform time-based blind SQL injection attacks to exfiltrate sensitive data, such as patient records and bcrypt hashes of user credentials.

Impact

Successful exploitation allows authenticated attackers to perform unauthorized data extraction, leading to the compromise of patient PII and user authentication data (bcrypt hashes).

Recommendation

Upgrade to OpenEMR version 8.3.0 or later to address the vulnerability.
Audit access logs for abnormal POST request patterns to the DrugSalesService or Fee Sheet-related endpoints containing SQL injection syntax, particularly within the prod[N][warehouse] parameter.

OpenEMR: Insecure direct object reference in portal/lib/persist.php (CVE-2026-124453)

hello@craftedsignal.io — Sun, 08 Nov 2026 19:33:41 +0000

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php. Authenticated portal patients can modify the setting_patient parameter in a JSON POST request to another patient's PID, allowing them to alter that patient's portal settings, such as the portal theme.

OpenEMR: Missing authorization in billing module (CVE-2026-124471)

hello@craftedsignal.io — Sun, 08 Nov 2026 17:30:44 +0000

OpenEMR versions prior to 8.3.0 are vulnerable to a missing authorization flaw in 'interface/billing/sl_eob_invoice.php'. The vulnerability allows an authenticated user to perform unauthorized operations by manipulating the 'id' parameter in HTTP requests. Impacted operations include reading patient names and billing notes, posting payments, applying adjustments, and deleting billing entries for any encounter regardless of the user's assigned permissions.

Impact

Successful exploitation allows for unauthorized data disclosure (PII/PHI) and modification of financial and clinical billing records across all patient encounters.

Recommendation

Upgrade OpenEMR to version 8.3.0 or later to remediate CVE-2026-124471.
Audit access logs for the 'interface/billing/sl_eob_invoice.php' endpoint to identify patterns of excessive or abnormal requests to the 'id' parameter by non-billing personnel.

OpenEMR: Stored Cross-Site Scripting (CVE-2026-124463)

hello@craftedsignal.io — Sun, 08 Nov 2026 17:30:33 +0000

OpenEMR versions before 8.3.0 contain a stored cross-site scripting (XSS) vulnerability. Authenticated users with CAMOS (Computerized Assisted Medical Office Suite) access can inject malicious HTML or scripts by saving content through the ajax_save.php endpoint. The payload is subsequently executed when a victim accesses the entry via the rx_print.php script (specifically the non-print_html branch), allowing the attacker to perform actions or read data as the authenticated user.

Impact

Successful exploitation allows authenticated attackers to perform unauthorized actions or exfiltrate sensitive data by executing scripts within the browser session of a victim user who views the malicious content.

Recommendation

Upgrade OpenEMR to version 8.3.0 or later to remediate the vulnerability.
Audit access controls for the CAMOS module to ensure only trusted users have the ability to save content.
Monitor web server logs for suspicious POST requests to ajax_save.php containing script-related characters.

OpenEMR: Arbitrary file read and write vulnerability (CVE-2026-124450)

hello@craftedsignal.io — Sun, 08 Nov 2026 16:50:56 +0000

OpenEMR versions prior to 8.3.0 contain a broken access control and path traversal vulnerability in the fax/sms module's 'disposeDocument' action. The vulnerability stems from an unvalidated 'file_path' parameter, which allows authenticated, low-privileged users to perform arbitrary file reads (including the retrieval of database credentials from 'sqlconf.php') and arbitrary file writes as the web service user, ultimately leading to remote code execution.

Impact

Authenticated low-privilege users can recover database credentials, modify application configuration, or achieve remote code execution on the underlying server as the web service user.

Recommendation

Patch OpenEMR to version 8.3.0 or later immediately to resolve the vulnerability.
Audit access logs for authentication-related activity followed by suspicious requests to the 'fax/sms' module.
Monitor for unauthorized file modification in the OpenEMR web directory.

OpenEMR: Broken access control in portal_payment.php (CVE-2026-124489)

hello@craftedsignal.io — Sun, 08 Nov 2026 15:36:54 +0000

OpenEMR versions before 8.3.0 contain a broken access control vulnerability in the portal/portal_payment.php script. An authenticated attacker with low privileges can bypass billing access control list (ACL) checks by manipulating the pid and form_pid parameters in requests. This allows unauthorized access to patient payment pages and the submission of fraudulent payment receipts, resulting in billing data corruption.

Impact

Successful exploitation allows unauthorized users to view sensitive payment data of arbitrary patients and inject fraudulent payment records into the system, compromising the integrity of financial billing records.

Recommendation

Upgrade OpenEMR to version 8.3.0 or later immediately to patch the access control vulnerability in portal_payment.php.
Audit billing records for entries created by low-privilege accounts, specifically looking for irregularities in pid and form_pid parameter associations.

OpenEMR: Missing authorization in patient recall records (CVE-2026-124477)

hello@craftedsignal.io — Sun, 08 Nov 2026 15:36:08 +0000

OpenEMR versions before 8.3.0 contain a missing authorization vulnerability (CVE-2026-124477) that allows low-privileged authenticated users to delete arbitrary patient recall records. The vulnerability is triggered by sending a POST request to /interface/main/messages/save.php with the delete_Recall action, targeting a specific patient ID (pid) and record ID (r_ID). The application fails to perform necessary Access Control List (ACL) or ownership checks before processing the deletion, leading to unauthorized data loss.

Impact

Successful exploitation allows an authenticated attacker to delete patient recall data, potentially causing medical records disruption or data loss.

Recommendation

Upgrade OpenEMR to version 8.3.0 or later immediately to resolve the missing authorization check.
Audit access logs for unauthorized access or execution of the delete_Recall action by low-privileged user accounts.

OpenEMR: Broken object-level authorization in SOAP note API (CVE-2026-124473)

hello@craftedsignal.io — Sun, 08 Nov 2026 15:35:53 +0000

OpenEMR versions prior to 8.3.0 contain a broken object-level authorization (BOLA) vulnerability in the SOAP note update API. The application fails to verify that the provided SOAP note ID (sid) is associated with the patient and encounter specified in the request URI. An authenticated user with existing "encounters/notes" permissions can perform a PUT request to the API, allowing them to overwrite existing clinical notes and reassign the records to a different patient ID.

Impact

Successful exploitation results in unauthorized modification of clinical records and data integrity compromise within the electronic medical record system.

Recommendation

Upgrade OpenEMR to version 8.3.0 or later to resolve the underlying authorization logic flaw.
Audit web server logs for PUT requests to the SOAP note API where the requested Patient ID (pid) or Encounter ID (eid) may be inconsistent with access patterns or user-specific permissions.
Review access control logs for users with "encounters/notes" permissions to identify anomalous update activity.

OpenEMR: Missing authorization in billing notes (CVE-2026-124472)

hello@craftedsignal.io — Sun, 08 Nov 2026 15:35:35 +0000

OpenEMR versions before 8.3.0 contain a missing authorization vulnerability in the script 'interface/billing/sl_eob_patient_note.php'. This vulnerability enables an authenticated user to perform unauthorized read and modification operations on patient billing notes. By manipulating the 'patient_id' parameter in HTTP POST requests and reusing legitimate CSRF tokens, a low-privilege attacker can access confidential data belonging to other patients.

Impact

The vulnerability allows unauthorized access to and tampering with patient billing records, which constitutes a significant compromise of protected health information (PHI) and data integrity within the OpenEMR instance.

Recommendation

Upgrade OpenEMR to version 8.3.0 or later immediately to remediate the missing authorization check.
Review application access logs for anomalous POST request patterns directed at 'sl_eob_patient_note.php', specifically where the 'patient_id' parameter varies rapidly or is accessed by accounts that lack administrative or billing roles.
Audit user permissions and ensure that Principle of Least Privilege is applied to all clinical and billing staff accounts to limit the blast radius of compromised credentials.

OpenEMR: Missing authorization in document upload (CVE-2026-124461)

hello@craftedsignal.io — Sun, 08 Nov 2026 15:34:30 +0000

OpenEMR versions prior to 8.3.0 contain a missing authorization vulnerability in 'library/ajax/upload.php'. This flaw permits an authenticated user to perform unauthorized read and write operations on document data by manipulating the 'doc_id' parameter.

Impact

Successful exploitation allows low-privileged users to enumerate document IDs, leading to the unauthorized disclosure of patient health information (PHI) and the potential tampering of medical records across the entire installation.

Recommendation

Upgrade OpenEMR to version 8.3.0 or later to remediate the authorization logic flaw.
Implement strict access control monitoring for requests directed to 'library/ajax/upload.php'.
Review application access logs for abnormal volumes of requests to the document upload endpoint, specifically those targeting sequential or unusual 'doc_id' values.

OpenEMR: Insecure Direct Object Reference in encounter-form endpoints (CVE-2026-124459)

hello@craftedsignal.io — Sun, 08 Nov 2026 15:32:29 +0000

OpenEMR versions before 8.3.0 contain an insecure direct object reference (IDOR) vulnerability in multiple encounter-form view and save endpoints. These endpoints fail to perform patient or encounter ownership validation checks. An authenticated clinical user can leverage this by incrementing sequential form ID values within HTTP requests to view or overwrite clinical data belonging to other patients.

Impact

Successful exploitation allows an authenticated attacker to read sensitive clinical records and modify or overwrite medical data belonging to other patients, leading to potential data corruption and unauthorized information disclosure.

Recommendation

Upgrade OpenEMR to version 8.3.0 or later immediately to patch the missing ownership checks.
Restrict access to clinical form endpoints for non-clinical user roles if the update cannot be applied immediately.
Implement granular auditing of access to encounter-form endpoints to identify anomalous enumeration patterns.

OpenEMR: Missing authorization and IDOR in oe-module-prior-authorizations (CVE-2026-124456)

hello@craftedsignal.io — Sun, 08 Nov 2026 15:32:12 +0000

OpenEMR versions prior to 8.3.0 contain missing authorization and insecure direct object reference (IDOR) vulnerabilities within the oe-module-prior-authorizations module. These flaws allow an authenticated low-privilege user to access and manipulate sensitive patient data, including patient names, medical record numbers (MRNs), insurance details, and prior-authorization records.

Impact

Successful exploitation allows for unauthorized disclosure of Protected Health Information (PHI) and unauthorized modification of patient prior-authorization records.

Recommendation

Upgrade OpenEMR to version 8.3.0 or later to apply the security fixes.
Restrict user access to the oe-module-prior-authorizations module if immediate patching is not feasible.
Monitor access logs for requests to public/reports/list_report.php and public/index.php that deviate from expected behavioral patterns for low-privilege user accounts.

OpenEMR: Stored cross-site scripting in CCDA/CCD preview (CVE-2026-124448)

hello@craftedsignal.io — Sun, 08 Nov 2026 15:31:55 +0000

OpenEMR versions prior to 8.3.0 contain stored cross-site scripting (XSS) vulnerabilities within the CCDA/CCD preview stylesheets. Specifically, the cda.xsl and ccd.xsl files fail to properly sanitize input, allowing event-handler attributes such as onmouseover, onclick, and onfocus to be injected into previewed HTML. An authenticated attacker can upload a crafted CCDA/CCD document containing these malicious handlers to execute unauthorized JavaScript in the context of a clinician's session.

Impact

Successful exploitation allows authenticated attackers to execute arbitrary JavaScript within a clinician's session, potentially leading to unauthorized data access, session hijacking, or other actions performed with the clinician's privileges within the OpenEMR application.

Recommendation

Upgrade OpenEMR to version 8.3.0 or later to apply the fix for CVE-2026-124448.
Implement Content Security Policy (CSP) headers that restrict inline script execution to reduce the impact of XSS vulnerabilities.
Audit access logs for user accounts uploading CCDA/CCD documents to identify potential abuse of the file upload functionality.

OpenEMR: Insecure direct object reference in OnsitePortalActivityController (CVE-2026-124447)

hello@craftedsignal.io — Sun, 08 Nov 2026 15:31:47 +0000

OpenEMR versions before 8.3.0 are susceptible to an Insecure Direct Object Reference (IDOR) vulnerability located in the OnsitePortalActivityController::Update() function. The application fails to validate whether the authenticated patient ID matches the record owner ID. An attacker with a valid patient portal account can manipulate PUT requests to the onsiteportalactivity API by specifying arbitrary activity IDs alongside their own patient ID. This leads to the unauthorized disclosure of tableArgs and checksum data, as well as the ability to overwrite activity narratives and status, effectively allowing the attacker to assume ownership of another patient's medical activity records.

Impact

Successful exploitation allows unauthorized disclosure of sensitive medical activity data, modification of existing record narratives and status fields, and account-level record takeover within the OpenEMR patient portal.

Recommendation

Upgrade OpenEMR to version 8.3.0 or later to include the fix for CVE-2026-124447.
Audit web server logs for suspicious PUT requests to the onsiteportalactivity API endpoint, specifically monitoring for instances where the authenticated user ID is linked to record IDs that do not belong to that session context.

OpenEMR: Path traversal in RingCentral RCFaxClient (CVE-2026-124490)

hello@craftedsignal.io — Sun, 08 Nov 2026 15:29:19 +0000

OpenEMR versions before 8.3.0 contain a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument() method of the oe-module-faxsms component. An authenticated attacker can exploit the file_path parameter to read sensitive files, such as configuration files containing credentials or source code. Furthermore, an attacker can use the action=setup parameter with base64-encoded content to write web-executable files, leading to remote code execution.

Impact

The vulnerability allows authenticated attackers to perform unauthorized file system reads and writes, resulting in potential exposure of sensitive data (credentials/source code) and full system compromise via remote code execution.

Recommendation

Upgrade OpenEMR to version 8.3.0 or later immediately to resolve the vulnerable disposeDocument() method.
Audit web server access logs for requests directed at the oe-module-faxsms component containing path traversal patterns (e.g., ../, ..).
Review user access privileges for the OpenEMR instance to limit exposure to authenticated session exploitation.